5 ms·
Adversaries do not have to wait for LLM models to evolve to mimic human process, they can simply evade the detection JavaScript that evaluates similarity. JavaS
by kjok 4mo ago
Adversaries do not have to wait for LLM models to evolve to mimic human process, they can simply evade the detection JavaScript that evaluates similarity. JavaScript is visible, can easily be reverse-engineered.
- graypegg 4mo agoI don't think I've ever known of a captcha that handles the actual result decision in the front end. It's universally just the javascript required for some fancy puzzle UI, which forwards the state to some other endpoint to determine where you're redirected to (CF turnstile) or what signed token should be included in the form request (reCAPTCHA)
- kjok 4mo agoI should have been clearer and specific: state management is done on the backend, but collecting behavioral biometrics and device fingerprint is done using JavaScript, which can be manipulated.
- IshKebab 4mo agoYou can do it server side. But even so I would think this sort of heuristic detection is unreliable, annoying to real users, and not difficult to circumvent if the attackers actually tried.
- ranger_danger 4mo agoI think it will always be a cat and mouse game as you could also detect such evasions in the first place.