> At the moment, it seems Basic mode is so basic that it allows everything to pass as human. That’ll likely change as they gather more telemetry to better identify what a bot signal looks like.
So they are basically collecting telemetry in the name of "free basic anti-bot" solution.
codedokode · 3h ago
Note that the bot detection script uses WebGL to obtain GPU name. I assume this (fingerprinting) is the most popular use of WebGL. Sad that independent browsers like Firefox do not supply fake values.
nullpt_rs · 3h ago
Sadly, spoofing GPU vendor & renderer can be an even larger flag since they can hash the resulting image of the canvas to compare it with a database of collected fingerprints[0]
Until a major player gets on board. Then it works.
Apple does this by sending an imposter user agent from Safari on iPads.
If only that was expanded to iPhones, too. And then send rotating, or randomized user agents.
nerdsniper · 2h ago
Apple does it because they don’t have a vested financial interest in internet-wide tracking.
Google does.
And while Mozilla does too because the vast majority of their funding comes from Google, it’s more pertinent that they don’t have the market share to pull this off. Firefox would just stop working on major websites if they did this.
andrewmcwatters · 2h ago
It’s funny that trying to click on the Google Scholar link there falsely identifies me as a bot.
b0a04gl · 38m ago
why is bot detection even happening at render time instead of request time. why can't tell you’re a bot from your headers, UA, IP, TLS fingerprint. imo making it a surveillance. 'you're a bot, ok not just go away, let’s fingerprint your GPU and assign you a behavioral risk score anyway'
n2d4 · 31m ago
It's really hard to detect it at request time. It's practically trivial for an attacker to fake headers to resemble a real browser.
So they are basically collecting telemetry in the name of "free basic anti-bot" solution.
[0]: https://research.google/pubs/picasso-lightweight-device-clas...
Apple does this by sending an imposter user agent from Safari on iPads.
If only that was expanded to iPhones, too. And then send rotating, or randomized user agents.
Google does.
And while Mozilla does too because the vast majority of their funding comes from Google, it’s more pertinent that they don’t have the market share to pull this off. Firefox would just stop working on major websites if they did this.