[eatbots]

Our system is indeed designed not to leak detections in real-time. By contrast, with reCAPTCHA you can simply sign up and get a bot score, which makes it trivial to break.

This limits options for the free version they tested, as by design it will not completely prevent all detected automation from passing.

Instead, one of the tools it relies on is frequently changing the classes and types of challenges. However, it also has “anti-drain” protections to avoid leaking these.

Thus, our response to them after looking through the paper was that in fact the anti-drain protections were working as designed, based on the other details reported.

disclosure: work there.

[yorwba]

> This limits options for the free version they tested, as by design it will not completely prevent all detected automation from passing.

"Not completely prevent all" seems to mean "prevent about 5%", which is cold comfort for users who expected better. If they had paid for the service, would they have gotten better results (i.e. fewer successful bot sign-ups)?