Cloudflare Precursor Watches Your Mouse and Keyboard To Decide If You Are Human (nerds.xyz) 87
BrianFagioli writes: Cloudflare has launched Precursor, a new behavioral bot detection system that monitors mouse movement, typing cadence, scrolling, clipboard activity, page visibility, and other signals across an entire browsing session. The system is designed to catch advanced bots that can run JavaScript, use real browsers, and pass traditional CAPTCHA challenges. Cloudflare says Precursor does not record actual keystrokes and instead studies timing and rhythm. The company also says the data is not tied to user identities or persistent profiles. Even so, software that watches how people move and type throughout a visit raises privacy concerns, especially as Cloudflare claims bots now generate roughly 57 percent of all Internet requests.
People do the same. (Score:4, Interesting)
Everyone my age knows what the stereotypical 'robotic' voice is. They changed it because they wanted to hide the fact you were talking to a machine.
We all know that a mouse moving in a perfectly straight line means a machine is controlling it, while humans do something more like a squiggly line. Basically a normal human drawing a line looks like someone with Parkinsons did it as compared to what a machine drawing a line looks like.
Similarly, humans typing have pauses that tend to end after set thoughts. New sentence = a pause. If I am seeing a long unbroken, steady text output or text that all appears in full sentences quickly, I know it is a machine.
Re: People do the same. (Score:5, Interesting)
Re: (Score:3)
I guess Antigravity (the IDE) has no problems with Googles Antigravity to remote control my browser and solve most CaptChas for me.
Yesterday I had a funny CaptCha failure, had to repeat it like 5 times. The items it wanted me to click simply were not as often in the pictures as "the algorithm" thought there should be.
Took ten minutes to finally get through ...
Re: (Score:3)
Indeed it would sound very easy, except that human movements aren't random, and with proper statistical models it's quickly possible to determine someone who didn't know the difference between natural restricted and biased variance and randomness.
You're the target audience here: the people who think that this "sounds incredibly easy" will be the first to have their bots blocked. Yeah it'll be worked around, but the bar is raised in the meantime.
Re: (Score:3)
Indeed it would sound very easy, except that human movements aren't random, and with proper statistical models it's quickly possible to determine someone who didn't know the difference between natural restricted and biased variance and randomness.
You're the target audience here: the people who think that this "sounds incredibly easy" will be the first to have their bots blocked. Yeah it'll be worked around, but the bar is raised in the meantime.
You're not wrong. But the same data that describes what is and isn't human input can be used to create activity that matches that data. If Cloudflare has gathered the information, someone else can as well.
This mirrors the spam arms-race that started a couple decades ago.
Re: (Score:2)
Worth noting we've already done this. ReCaptcha has used input characterisation for a long time now. Again I didn't disagree it'll be worked around, just that it won't be as easy as people think.
There's a difference between capturing and replaying data (something that will be easily detected, humans are biased but still have variance), and properly generating a human looking input. This is harder than people think.
Re: (Score:2)
yes, but humans aren't random... so linear speed is a bot, totally random is a bot. Add that info from multiple inputs like cloudflare is doing and probably can guess within a error margin if it is a bot or a human... hey, even if it fails to detect 50% of the bots, it is already 50% less traffic arriving to a site.
Sadly there is no way to detect 100% of the bots/humans, but every hint helps.
Of course, people using bots could be much nicer and use correct user-agents to identify thyself and allow sites to
Re: (Score:2)
If you record your mouse movements yourself, it should be very simple to train an AI to generate similar paths. A transformer or even LSTM with source, target and previous way points should be able to predict the next "natural" waypoint if you train it on a few thousand (maybe even a few hundred) traces. The funny thing is, that the network you need is probably quite similar to the network Precursor may be using to verify if it is natural or not.
Re: (Score:2)
sure, but again, if it blocks 50% of the bots, it is 50% less bots arriving and more resources that the remaining 50% have to use in order of not being blocked. For sure cloudflare will have other detections too! like a onion, many layers, there isn't one that solves all, but all together can make a good filter
Re: (Score:1)
Sounds incredibly easy for bots to add some randomness to its movements and typing speed.
Sure, but are bots still economically feasible if they run as slow as humans?
Re: (Score:2)
One bot can be slow at a lot of sites at the same time.
Re: (Score:2)
Common browser automation tools already have plugins for that. But Cloudflare isn't stupid either, the current standard techniques probably won't work. But I won't bet they win the game in the long run.
Re: (Score:2)
Unless your mouse has angle snapping or is a wireless mouse and there is movement lag because of interference.
Re: (Score:2)
Re: (Score:1)
Well, you're using a machine to control your mouse, so what do you expect?
If you're gonna say that, a mouse is a machine as well. All input devices are. Maybe we all actually are machines? Oh good, fourth existential crisis of the day incoming.
Re: (Score:2)
Sucks for people with accessibility issues though. Moving the mouse in a straight line, say because they have a joystick or their eye tracking software interpolates, is going to get them blocked or forced to do a long captcha challenge that isn't very accessible either.
Re: (Score:1)
This shit is why I quit adtech in 2014. Everything that they tout was industry practice 12 years ago.
Re: (Score:3)
cloudflare is not doing anything new actually, other that using this data to detect bots... you already have sites that mouse, keyboard and clicks, mostly to learn how you interact with the site and what features work/get used and do not work
If they could map your eyes, they would be happy to follow your eyes to guess to what you are looking at... to see if that ad is working or not
So don't blame cloudflare, while they are huge and that is already a problem, they are mostly good guys... the problem is all t
Re: (Score:2)
One of my real issues with the web in general is that any session should be me and the site I am loo
Re: (Score:2)
cloudflare is a proxy, while the computer have access to your data, it doesn't store it. They have compliance rules to follow and audits, to make sure that a credit card number is not stolen in transit in cloudflare. Even a hacker inside cloudflare would have problems to access the info, exactly because they are required to make it hard to access that info. I'm excluding 3 letters agencies demanding the info in a secret way, as that can happen in any place (and for sure they can fake certificates to act as
Re: (Score:2)
Re: (Score:2)
they see the bank traffic to be able to filter bad traffic. cloudflare have a feature to not store the TLS cerficate on cloudflare, that talks with the bank backend to share data and negotiate the TLS. In that case, i'm not sure if cloudflare actually can decrypt the traffic... but again, even if they can, the system in place blocks bad usage of that data, only the automatic WAF filtering see that traffic and is blocked as much as possible from anyone abusing this.
The keystrokes are analyzed, not stored. bu
Re: (Score:2)
Re: (Score:2)
well, telling that cloudflare is a XSS is a little too much! :)
they do not care about any of the site data, they only care about their metrics and those all anonymized
i understand, but i work for one of those sites... and no, we can't expose one part without cloudflare, the few forgotten urls/sites not protected by cloudflare are quickly found down either to high load (from all the bots) or down due to some attack
you can have your own WAF and security team trying to do the same as cloudflare, but they actua
Chrome only, I assume (Score:3)
Safari and Firefox would likely block this, given it's a third party JavaScript tool.
Re: (Score:2)
Re:Chrome only, I assume (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Cloudflare has a free plan that most of the little mom and pop websites use.
Re: (Score:2)
I wonder what they gain from the free plan. It can't be that they think companies wouldn't know about Cloudflare if they would not have a free plan for mom and pop's site. I guess it is more like they can, for example, collect a lot of mouse movement information on the sites behind free Cloudflare to train their detection on how current bots move the mouse and how humans do. And you're happy if it's only mouse movement they collect.
Re: Chrome only, I assume (Score:2)
Re:Chrome only, I assume (Score:4, Informative)
you know that these features already exist in javascript and are commonly used to monitor user behavior, either for ads or for study how you interact with sites?!
https://developer.mozilla.org/... [mozilla.org]
the only difference here is that this is being used to check for bots and cloudflare announced it... most other companies use this and do not announce it
Re: (Score:2)
Re: (Score:2)
there are probably better ways than identify users by mouse/keyboard data...
chrome for instance have a unique ID in every browser, so google can identify that browser no matter if you clean cookies, create new profiles or even use different users in your machine. the browsers id is the same and set during download.
That is why chromium also have to have a google id to access google services and de-googled chromium can't access those services, because without the ID, they will refuse to work
From the article it's just browser fingerprinting (Score:2)
I'm actually a little surprised they didn't already have a fingerprinting product.
Re: (Score:3)
I suspect GP's point is that every malware blocker in every browser is likely to treat this kind of script as hostile, except for Chrome because Google are currently nerfing the ability for blockers to intercept hostile scripts in one of the most blatantly user-hostile changes they've ever made.
If Apple play along with Safari then every other browser and its malware blocking plugins are about to be toast in a huge retrograde step for Internet privacy. But not even Cloudflare is going to get away with blocki
Re:From the article it's just browser fingerprinti (Score:4, Interesting)
Did anyone mention recently that simultaneously controlling both the most popular web browser and several of the most popular ad-supported web properties might be a little anticompetitive, and that it's about time that Google was broken up? It's probably time for that drum to start beating a bit louder again.
I remember when Microsoft got hit with an anti-trust suit because they bundled the browser with the OS. Here in 2026 Google owns the browser, the OS and the search engine. If you're on a chromebook or a Pixel they also control the hardware. Why is this allowed?
Re: (Score:3)
Did anyone mention recently that simultaneously controlling both the most popular web browser and several of the most popular ad-supported web properties might be a little anticompetitive, and that it's about time that Google was broken up? It's probably time for that drum to start beating a bit louder again.
I remember when Microsoft got hit with an anti-trust suit because they bundled the browser with the OS. Here in 2026 Google owns the browser, the OS and the search engine. If you're on a chromebook or a Pixel they also control the hardware. Why is this allowed?
For a particular definition of 'allowed', I guess the answer is: because they pay for it... [bbc.co.uk]
"Europe's top court has ruled Google must pay a €4.1bn (£3.5bn) fine handed down for using its Android mobile operating system to block rivals.
When the fine was first announced in 2018, it was alleged there were three ways in which Google had acted illegally:
[1] - requiring Android handset and tablet manufacturers to pre-install the Google Search app and its own web browser Chrome as a condition of allowing
Re: (Score:3)
For a particular definition of 'allowed', I guess the answer is: because they pay for it... [bbc.co.uk]
I hadn't seen that, thanks for the link.
Re: (Score:2)
... and fittingly, gotta turn off Javascript to view the link. Best sort of paywall, though -- the variety you can opt out of with one click.
Re: (Score:2)
... and fittingly, gotta turn off Javascript to view the link. Best sort of paywall, though -- the variety you can opt out of with one click.
It worked OK for me. I'm using PiHole with the default settings, no adblocker. I find the BBC too infested with ads to use without something to reduce the ads.
Re: (Score:2)
Two reasons it's allowed.
1. The iPhone sells well.
2. Android lets you replace most of the OS, including core parts like Google Play Services.
There is definitely a case for requiring better interoperability where people do things like replace Play Services and then find that their banking app won't open because there is no way to tell it that the device is secure, but it's mostly enough to ward off Microsoft style anti-trust issues.
Re: (Score:2)
Safari and Firefox would likely block this, given it's a third party JavaScript tool.
I am not sure it would be considered a "third party JavaScript tool". Once you gave the key to your domain to cloudflare, the domain resolves to a cloudflare IP and cloudflare act as a reverse proxy contacting to your site thus enabling them to inject any javascript without being viewed as third party.
whitelist sites that don't use Cloudflare (Score:1)
I shouldn't have to unblock nefarious Javascript on a random website to provide I am human.
If you're worried about bots, don't punish humans.
This company is fucking EVIL.
Re:whitelist sites that don't use Cloudflare (Score:4, Interesting)
I shouldn't have to unblock nefarious Javascript on a random website to provide I am human.
If you're worried about bots, don't punish humans.
This company is fucking EVIL.
People use Cloudflare because otherwise crawlers, mostly AI, make their websites unusable. Punish the people running the bots, not the people trying to protect themselves.
Re: (Score:2)
Well, this whole cloudfare crap also makes their websites unusable.
Re: (Score:2)
You can opt out of Cloudflare by clicking the 'x' to close tab.
I find myself doing this frequently and not always voluntarily. Haven't even bothered to check whether it's Clownflare, but most likely. ... oreillyauto.com ... "ACCESS DENIED." Ok. advanceautoparts.com... thanks for playing. It's almost like they don't know their competitor is one line higher or lower in the search results.
Re: (Score:2)
I prefer Ctrl + F4. Any other suggestions, Captain Obvious?
Re: (Score:3)
why? what is your problem with it?
yes, the captchas are annoying, but cloudflare already did their best to avoid showing them and make then as easy as click a box (instead of select 3 or 4 times images or try to read some distorted letters/numbers)
Yes, they are big and control many site traffic, that is a danger, but mostly to the sites, not the user... but they are also big because they work well and are much cheaper than most alternatives (that usually even perform worse)
Yes , a site without it would be b
Re: (Score:2)
Click a box, then click it again, and again and again only to see the message "your browser is not supported by cloudfare". Fuck them. If the website owner doesn't want me to see their website, then so be it.
Re: (Score:2)
yes, i agree that is annoying and is also my main complain about cloudflare captchas.
I understand that part is cloudflare fault, by testing many browser corner cases and so they target the latest browser versions to match their statistical distribution
another part is site owners, that may have enable the "required up to date browser" in cloudflare settings
and finally a part is user fault, many people use browsers "requiring updated" for weeks... at least from my experience, i see many people in meetings wit
Re: (Score:2)
I find that Anubis is a lot, lot less of a pain in the arse than Cloudflare's captchas. Usually I said right through Anubis in a second or two. Cloudflare usually requires at least a click, and often a stupid game.
Re: (Score:2)
agree, but anubis doesn't really work on everything...
anubis waste resources and slow down requests, this protect against normal scrapers and AI... but i doesn't protect against attacks. if the host is yours, anubis forces you to waste more money, but attacks use someone else resources, they use infected devices all over the place, so if their CPU is 100% or not, it doesn't matter much... yes, it may still slow down the attack, but the attack can bypass it by just adding more vulnerable hosts if really need
Re: (Score:2)
Re:whitelist sites that don't use Cloudflare (Score:5, Insightful)
This overlooks the spam traffic coming from cloudflare. Also cloudflare was an actual intelligence project (quoted here):
https://www.devever.net/~hl/cl... [devever.net]
"Back in 2003, Lee Holloway and I started Project Honey Pot as an open-source project to track online fraud and abuse. The Project allowed anyone with a website to install a piece of code and track hackers and spammers. We ran it as a hobby and didn't think much about it until, in 2008, the Department of Homeland Security called and said, 'Do you have any idea how valuable the data you have is?' That started us thinking about how we could effectively deploy the data from Project Honey Pot, as well as other sources, in order to protect websites online. That turned into the initial impetus for CloudFlare."
Re: (Score:2)
Sorry, but wrong. Currently AI is often blatantly wrong in ways that people would never be, but most of the time it does a narrowly specified job decently. It's just that when it doesn't, you may REALLY notice it.
Re: (Score:3)
That's what CloudFlare is for. To make sure you haven't turned JavaScript off, are not blocking ads and have an acceptable level of tracking allowed.
Web site operators with ads aren't nearly as interested in blocking bots. They get paid for ad views. Prove that it wasn't a human that clicked that MongoDb banner. Or pay up.
It's the advertisers that should be screaming about the scraping. They're the ones that have to write the checks to the site owners.
Re: (Score:2)
Re: (Score:2)
hey, the site i manage have no ads, people pay money ... we actually pay money to cloudflare.
we want to protect from attacks and all the bots and AI browsers are using a huge amount of resources, that we have to pay, so it is cheaper for us to pay cloudflare than scale the infra and pay for it.
and if you disable javascript, most site will actually not work (i know, i tried, i used noscript for many years), better option is use umatrix where you choose what to load or not or using a curated list like adblock
Re:Cloudflare is malware/spyware (Score:4, Interesting)
and if you disable javascript, most site will actually not work
And in the final analysis, that might be a good thing. Did you (your company) write that JavaScript? Probably not. You downloaded some crap from npm and included it in your pages.
IIRC, it was some npm installation scripts that allowed a "dependencies" section to include a URL for code to be included. From anywhere in the Internet. Bypassing the repository. And allowing the owner to place new code at that location any time they saw fit. Some of the exploits did things like encrypt your disk and ransom your data. Or steal your BitCoin wallets. Or AI development system tokens.
But quite a bit of low level stuff gets snuck into these repositories. Including stuff that lies quietly, damaging nothing. But inserting tracking code into your pages for the benefit of unknown third parties. So, no. I won't be loading your web pages along with a bunch of code that I don't know what it does. And neither do you.
I use umatrix and while i allow cloudflare javascript for captchas
CloudFlare got caught (by my ISP) for using a web site that was widely considered to be a scam site. I did a search on the URL and read a bunch of "interesting" reports on it. Including an email that Google had sent in response to the blocking, pleading with ISPs to stop it. Why was Google apologizing for ClownFlare's f*ck-up? My best guess is that they had piggybacked their own tracking stuff onto CFs Captchas. You just can't trust anyone who uses JavaScript anymore.
Re: (Score:2)
Re: (Score:2)
the fact that cloudflare was serving a scam site is also one of their strengths... they don't police the sites, everyone can have whatever they want there and cloudflare actively tried to give site owners the liberty to do that and fight all censor attempts... yes, sometimes it backfires, but you can't have freedom without also have to cope with some freedom abuses.
Try to limit the freedom abused and you will end limiting everyone freedom
Cloudflare do have DMCA, abuse report and many other things, but those
Re: (Score:2)
the fact that cloudflare was serving a scam site
Not serving. Linking to from within their own code.
Re: (Score:2)
are you talking about workers? that is still code deployed by the site owner
if you are talking about cloudflare javascript code for bot detection, captcha, that is not malware... spyware, while it grab several info, that is not actually stored, just analyzed by models. It is not identifiable information. A great example is the JA3 and JA4, it produces a hash that maps browsers/apps types but not users
The thing ... (Score:3)
The thing about computers is they can use machine learning until they generate randomness algorithms that work.
Re: (Score:3)
And cloudflare itself is giving them the reinforcement learning signal they need.
Ad agencies have been doing this (Score:2)
I understand the advertisement industry had been engaging in this, to help identify your typing cadence, mouse move, etc. This is something I read a long time ago, so the technique is not new; and I can only imagine what else they can infer from this data.
Ugh. This shit already exists. (Score:2)
And it always flags me as a bot because I type too damned fast. Or click to fast.
Re: (Score:3)
It also seems calculated to discriminate against handicapped folks that need mechanized assistance...but I may be wrong.
Re: (Score:2)
You're almost certainly not wrong. And if they can find a way to block women by accident they'll probably do that too.
Oh, fuck off (Score:2)
Cloudflare has launched Precursor, a new behavioral bot detection system that monitors mouse movement, typing cadence, scrolling, clipboard activity, page visibility, and other signals across an entire browsing session.
Nothing nefarious here, no potential for abuse, move along, move along.
Touchscreen (Score:2)
So what about people that don't use the mouse but use touchscreens?
Re: (Score:2)
it is the same, you press a random place in the area, not a exactly the center pixel.
when you type, you also have a distinct timing, not a constant speed
508 and JAWS (Score:3)
How does it interact with 508 and accessibility type devices/software like JAWS and other screen readers?
Sorry... (Score:3)
You have been deemed a non-person because you are not random enough for us. Your death certificate should arrive in the mail within two weeks.
Just use client SSL already (Score:2)
Bad guy here (Score:2)
Spoofable (Score:2)
I bet I can write a client that matches exactly the intended behaviour.
If it's in software, it can be emulated.
If it is not, it can be emulated anyway.
The problem is the server-side, not the client.
Ha. Old hat... (Score:2)
More than 35 years ago, well before the Internet, BBSes ruled.
One I was a pillar of was nothing but a wall where you would post anonymously (or not).
The software was written to verify the typing rate to make sure that no text was uploaded
CHALLENGE ACCEPTED!
I wrote a special terminal program that would randomize the time between characters to foil that BBS's rejection of uploads...
(Oh, it worked, and the dude running the show never found out).