Bad news for people whose hobbies include clicking pictures of buses for a virtual pat on the head from a computer: Cloudflare has unveiled a solution that requires no human intervention whatsoever.
The quick explanation is that rather than asking you to prove your humanity, the new system — called Turnstile — will ask your web browser to vouch for you instead via a “rotating suite of non-intrusive browser challenges based on telemetry and client behaviour.”
Ironically, that phrasing is just how a computer would put it, so here it is in human. In short, it’s looking for evidence from your browser that it’s not what it claims to be. For example, if a browser says it’s on a Samsung Galaxy S10 but it completes a verification puzzle significantly faster than that smartphone could ever hope to, it’s a red flag that it’s a sneaky data centre in disguise.
If there’s any doubt, Turnstile will provide increasingly tough tests, eventually giving you something like a CAPTCHA if it really can’t tell — but that shouldn’t occur in most cases. Cloudflare reckons that it takes the average human 32 seconds to complete a CAPTCHA, and this new process should take just one, all done behind the scenes.
This could also offer more privacy, Cloudflare argues, because it doesn’t look for ad or login cookies. That makes it different to Google’s reCAPTCHA system which uses a Google login cookie as a signifier of a human being. And while Google says this isn’t used for personalised ads, it theoretically could be — something which isn’t possible via Turnstile.
Of course, if this system is widely adopted, then those who want to pretend their bots are human will no doubt be intent on beating the newlook system, which probably explains the nuts and bolts of how Turnstile works hasn’t been expanded upon.
But for now, it sounds like we’ll be getting a bit of respite from the constant need to identify buses — or in the case of one charming instance, I was delivered the other day — big cats.
Turnstile is free to implement on your website, even if you’re not a paying Cloudflare customer. If you want to give it a spin, check out the full instructions on the official blog post.
