[amirhirsch]

I implemented all of this in hCaptcha 6 years ago, not just to distinguish bot from human but also to recognize the keyboard/mouse behavior of the same person signing up for many accounts or testing multiple credit cards. This kind of abuse detection was a part of Cloudflare when they switched to hCaptcha in 2020 and I had thought they already implemented all this themselves four years ago when they transitioned away from hCaptcha in 2022.

[Chu4eeno]

Didn't recaptcha v3 also do this? iirc the "silently monitor in the background" was part of the selling point.

[amirhirsch]

Yea this is the premise behind all the invisible captchas, combined with browser fingerprinting. Same tech is used now to detect distillation rings.