I’ve actually noticed this in some websites the past ~two months. It’s neat to have a captcha that finally doesn’t need slowly clicking images to pass through.

    • Windex007@lemmy.world
      link
      fedilink
      English
      arrow-up
      28
      arrow-down
      2
      ·
      1 year ago

      Yeah, I’m pretty skeptical of the premise… it’s looking for browser “abnormalities”? I mean… there wasn’t a strong motivation to correct those abnormalities for bots when it didn’t matter. Now that it does, I just suspect they’ll correct those abnormalities.

      Just because the abnormalities were present in the past doesn’t imply that it’s intrinsically more difficult to emulate browser behaviour than it is to defeat captchas. There just hasn’t been a reason to do so up until now.

    • DogMuffins@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      11
      ·
      1 year ago

      I’m curious how easy it would be to bypass with significant volume though?

      Like a few requests might get through but it would get fairly easy to detect dozens of requests from the same bot i think?

      It’s also doing some “light” proof of work - this would be a PITA if you were trying a bot net attack or something.

    • httpjames@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      12
      arrow-down
      1
      ·
      1 year ago

      Nothing can stop 100% of bots. The goal with captchas like Turnstile is to use a significant portion of your resources to the point it’s expensive and slow to perform an attack.

      Turnstile runs many background checks on your browser, so headless browsers automatically become futile.

      JavaScript PoW challenges are performed that take up multiple seconds of execution time, memory and CPU. This alone is a deterrent because sequential attacks become extremely long to execute.

      Concurrent attacks are still unfeasible because Turnstile ups the difficulty if it detects something is up, and receiving requests from thousands of botnet IPs is bound to trip an alarm.

    • verysoft@kbin.social
      link
      fedilink
      arrow-up
      6
      ·
      edit-2
      1 year ago

      I mean it’s always going to be an uphill battle, but I’d rather it stop some bots and be easier for me than them making me do a million captchas, that dont even work half the time, that still don’t stop many bots.

  • Jaydeep@lemmy.world
    link
    fedilink
    English
    arrow-up
    43
    ·
    1 year ago

    I absolutely hate it, in tachiyomi, it just keeps reloading the page instead of giving me a captcha to solve…

    • BloodSlut@lemmy.world
      link
      fedilink
      English
      arrow-up
      10
      ·
      1 year ago

      Same, I cant get to or log in to multiple sites with Firefox because of this.

      It does seem to be able to work if I use a private window, though. So Im not exactly sure what’s causing the issue. Maybe something to do with cookies? But ive messed around with that and havent been able to get anywhere.

      • FaceDeer@kbin.social
        link
        fedilink
        arrow-up
        5
        ·
        1 year ago

        You could check if it’s the fault of an extension by launching Firefox in safe mode (shift-click the Firefox icon when launching).

        • BloodSlut@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Thats a good idea. Ive tried doing it with certain other extensions (content blockers, user agents, script and tracker blockers/modifiers, etc.) disabled but something completely unrelated may be interfering.

  • nucleative@lemmy.world
    link
    fedilink
    English
    arrow-up
    32
    arrow-down
    3
    ·
    1 year ago

    Getting sick of these strange new hCaptchas. Click the thing that’s only appearing once? Click I this exact order 😱🥺😅😂🤞. Click the stadiums from SimCity?!? Hopefully websites switch to turnstile fast.

    • kadu@lemmy.world
      link
      fedilink
      English
      arrow-up
      22
      ·
      1 year ago

      I fail hCaptcha a surprising number of times, and I’m sure it’s actually doing that on purpose so we help it label more images for AI training.

      It’s like “select all flowers” and then you have 7 AI generated horses, and one AI generated flower. I pick the flower and “try again!” with a new set of images.

      • nucleative@lemmy.world
        link
        fedilink
        English
        arrow-up
        12
        ·
        1 year ago

        Yeah. Its better than reCaptcha - do I click those 3 pixels of the traffic signal it not!?! - but it’s still an obstacle that dimenishes the experience.

    • elouboub@kbin.social
      link
      fedilink
      arrow-up
      6
      arrow-down
      18
      ·
      1 year ago

      Wow, people will complain about literally anything. “I hate Google’s Recaptcha” –> hCaptcha. “I hate hCaptcha” –> turnstile. Inevitably it’ll be “I hate turnstile”.

      • nucleative@lemmy.world
        link
        fedilink
        English
        arrow-up
        29
        ·
        1 year ago

        Yes. Obstacles on the pathway to what I’m clicking in to are obnoxious. Hopefully turnstile isn’t an obstacle.

        • Saik0@lemmy.saik0.com
          link
          fedilink
          English
          arrow-up
          7
          arrow-down
          7
          ·
          1 year ago

          And websites the have to protect access to their resources. You don’t have an innate right to unimpeded access to someone else’s server.

  • smileyhead@discuss.tchncs.de
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    Don’t like it.

    I use VPNs, Tor and nonpopular browsers and I need to have a way to proof I am not a robot other than staying in the crowd.