I know there are other signals being used but this one in particular seems like it wouldn't be hard to beat with a small amount of sophistication from the bot.
Basic machine learning clustering will expose bots mouse+keyboard+touch behavior and discriminate them from humans.
It will also likely discriminate against anyone with a disability and therefore using affordances like eye tracking. Just imagine how different a person with only one hand would look compared to a “typical” user!! This shouldn’t be too much of a problem in the USA because no one is enforcing the ADA at the moment outside of California / Illinois / NY.
But I’m curious to hear from ‘eastdakota how they plan to guarantee that users with disabilities won’t be affected by these kinds of behavioral analysis. Cloudflare has such a massive footprint that it’s absolutely critical for them to err on the safe side of filtering, assuming they desire to be ethical.
The immoral thing for cloudflare to do would be to say “we just provide a ‘bot likeliness score’ and it’s up to each website to decide what threshold they need”. And then wave their hands and say “we’re not the ones blocking users with disabilities…the websites are the ones setting their thresholds too strictly”.
When you reach Cloudflare’s size … you own all the 2nd and 3rd order effects of your decisions.
This kind of data not only separates bots from humans - it’s pretty trivial to distinguish male vs female, right-handed vs left-handed, approximate age, native language (based on keyboard input patterns), state of injury (including tracking progression of healing), and a variety of different mental/physical disabilities. How one navigates a website tells you whether they are ADHD or schizophrenic or has Parkinson’s, and it can tell you about drug use/abuse: how well is this person’s Parkinson’s treatment working? What days of the week does that person tend to abuse amphetamines?
It is super difficult to mimic all of these signals in a way that would cluster the same as typical humans.
Because of this, perfectly mimicking humans is not a good goal for a bot (as it is the case for AI in music), because they would become very inefficient, at least latency wise (throughput could be engineered around by scraping many unrelated webpages in parallel).
Not really, beat ML with ML. I won't disclose how to do it, because who knows who might read this, but you can easily do it with a model trained for that purpose.
and you bootstrap with existing javascript detection engines.
the challenge is usually the human input data, your objective is to be clustered among the humans and for that you need to know what humans look like.
this is not an open ended arms race, it will end once the bots approximate humans to a sufficient degree - false positive rate for detection will become unacceptable even if the detection system is slightly ahead.
I'm sure, they can add a jitter, but then you just change how you detect / weight detection.
But that doesn't mean you shouldn't still try to block the much larger number of less sophisticated/resourced adversaries that are using OOTB libraries and low-effort setups.