Hacker News Reader

Hi Bronco, Omar here, a Lead Platform Engineer at Intuned.

> I've tried adding browser automation outside of the single click from the extension, and I'm immediately met with bot detection.

Can you explain how you write your automation? How do you do the click from the extension? Do you use CDP input commands to perform the click (`Input.dispatchMouseEvent`), or do you execute JS code and click the button using `element.click`? using CDP will give you much better score than Executing JS to click a captcha button. JS Execution can be easily detected by any bot detection provider. On the other hand, using CDP to click can mimic actual mouse movement and will make it much harder to detect abnormalities. and the click event will have `isTrusted=true` and handle detection methods related to monitoring JS executions on page.

> Do modified browsers drive the overall bot detection heuristic low enough that the cloud IP address itself isn't a red flag? I've seen Camoufox and will try it at some point. What other options are available to drive down the overall "score" so I can still automate the browser but keep the latency low?

Modified browsers reduce your bot score a lot, and Camoufox is a great option to test out. Will it work? It depends on how the website has set up their bot detection. using modified browser is a must for use case.

At Intuned, we use our own internal forked Chrome to hide the most popular signals, and a lot of the time, the browser alone without a residential proxy can help us bypass most websites, but not all of them(IP reputation has very high heuristic value).

I can't give exact recommendation on what will work with you for sure since each website has it's own ways to handle bot detection , one recommendation I can give is to try to use packages like patchright they can help alot and hide alot of popular signals.

Another recommendation I can make is to try using intuned agent and ask it to help you find a way to bypass bot detection on that website. If you can handle it using network interception or some other scraping technique, the agent is really good in these cases and knows most of the used scraping techniques.

Hey Omar, do you have any plan to add support for Web Bot Auth? https://datatracker.ietf.org/wg/webbotauth/about/

While I understand that not every business wants automation on their site, I know some businesses are totally open to it. But from a technical perspective, it's very difficult to allow well-behaved browser automation while still blocking abusive bots. Web Bot Auth gives website owners / security vendors a lightweight way to allow providers like Intuned.

(I work on the Web Bot Auth implementation for Stytch, now a part of Twilio: https://stytch.com/blog/stytch-supports-web-bot-auth/ )

Use the real browser: clawchrome.com. You can evaluate code on the page, do network capture, screenshot. But it’s the real browser, no fork, no cdp.

For lower RTT you’ll need an instance and proxy close to upstream but a real browser will help with scraping detection.

thanks! i asked my teammate working on bot detection to respond, he can better answer this!