Lately I’ve been seeing a popup from Cloudflare asking you are you human (or similar). All I have to do is click a box and the website will load. How does that prove I’m human? Is it the fact that a human would take near seconds to read and comprehend, then click a button compared to how long a bot would take? Why not the old picture matching? Are bots too smart for that now?
Sorry for the probably simpleton questions, but I need to learn!
As far as I can tell it’s a bit of a black box, but has been theorized to include looking up previous traffic from “you” in Cloudflare’s logs, client-side info (mouse position, etc.), the existence of various cookies which have marked “you” as “not a bot”… It’s like a captcha but more in-depth. It is possible for bots to solve the old school image captchas if I’m not mistaken, but here cloudflare is probably taking some extra time to leverage their place as part of the infrastructure of the web to try and figure out who you are and what you’re doing.
I suspect they appear more or less often for certain websites depending on the volume of automated traffic CF thinks that site is receiving.
Does it not do some math in the browser?
Because srapers don’t generally have a browser than can runs scripts?
Edit: I guess it could also be fingerprinting mouse moves and such
I read that is to prevent AI crawlers from causing too much traffic. This doesn’t mean the website you saw that on implemented that for that reason. I just don’t know why an AI crawler couldn’t just click the checkmark…..
So a website host that wants AI to find them, would not implement it.
Those old picture matching things actually were for you to train AI. those were awfully annoying….
AI crawlers going to every website:
The system apparently stops LLM agents using Selenium, which as far as I know is pretty similar to a real person using a browser. In other words it’s not just clicking the checkbox, from time to time on a slow connection you will get a little loading icon before moving onto your intended destination.
I thought it was the way you moved your mouse and where you clicked. If you moved in perfect lines or your mouse suddenly disappears from one location on the screen and instantaneously appeared perfectly over the box, then you were a bot. Idk.
I’m using my phone for all my online stuff rn. Android 15 on Pixel 10pro, DuckDuckGo browser using their vpn. So no mouse… but there is some fingering which might equate to a mouse.
A human has predictable reaction times in the “greater than nothing” range, and a human takes time to move their mouse or get their finger on the check box.
Picture matching is too easy now. It has been augmented with a comprehension task like “line the arrow up with the direction the horse faces”, which is reasoning most bots are really bad at.
i think it’s probably being triggered by your vpn
Funny I get them less on mobile, probably because of better Fingerprinting / less hardening possibilities on iOS.
Because it is a major annoyance for humans, and ai can do it relatively easily, there are also captcha-solving services where humans in poorer countries solve 1000 captchas per dollar so it is kind of not cutting it for scraper bots.
From what i understand, Cloudflare human verification is mostly based on recorded network traffic behavior of your ip since everything else can be faked easily enough. And since Cloudflare is so large so it sees a lot of the internet traffic.
All the people that are “caught” as a false positive have a very hard time getting out of naughty jail because there is not much they can do if the system flags them as a bot.
I personally had every single site harass me with the cloudflare question for the whole time i was using a wan bonding software (openmptcprouter) so all my traffic was effectively originating from my vps (a virtual machine hosted by Hertzner), and not from a residential ip address
Cloudflare prompts pretty much ALWAYS fail on my system under Firefox & Waterfox. Just because I may have my browser set to higher security does NOT mean I am an AI or bot (as much as I might have been accused of it on occasion). And I don’t use chromium-based browsers (except to connect to Cloudflare-infected sites just so I can tell them off).
We may have to shut the entire internet down and reboot it; as it is it’s become useless.
I’ve used their booter service strictly for load-testing my own setup, and it made it way easier to spot weak points without juggling a bunch of tools. The API support helped me automate repeat tests, and I liked that they don’t keep activity logs. If you’re trying to stress-test something you actually own and control, it’s a pretty chill way to push traffic without frying your gear.
Negative. I am a meat popsicle.
Nah. We are ugly bags of water , we exist to give money (directly or indirectly) to our AI corporate overlords.
Almost exactly my thoughts on this matter. HOWEVER, considering how often I see cloudcrap’s “are you human” nonsense, i believe its more of an advertisement for their company than any valid attempt to stop bots.
Maybe if they only showed the tests, i would believe differently. However i am mostly seeing their driveby “ad” these days without needing to complete some test.
I need to put that in the re-watch queue.
I’ve recently been seeing more and more Google’s recaptcha prompts (even in Chrome Incognito tabs), but not really Cloudflare’s. I also occasionally see the anime catgirl “making sure you’re not a bot” prompt for a second (or sth like that).
FWIW I’m using mostly Firefox (or Tor Browser) on desktop and Chrome + Opera on mobile.
Yeah I see catgirl more than anything else thesr days, often on tech related stuff oddly
Corbin Dallas Multi-pass 
Also I think the correct quote is:
“Ugly Bags of MOSTLY Water”
