5 ms·

I'm a founder in this space (www.roundtable.ai; YC S23) Behavior is a big missing link. Many CAPTCHA services (including Google reCAPTCHA v3) claim to use beha

I'm a founder in this space (www.roundtable.ai; YC S23) Behavior is a big missing link. Many CAPTCHA services (including Google reCAPTCHA v3) claim to use behavioral analyses, but you can disprove this using Operator to fill out a form and see reCAPTCHA and other bot detection systems flag it as a human. At Roundtable, we rely on first-order behavioral markers (keystroke, mouse, scroll, click) etc. When first-order are sufficiently spoofed, analyze higher-level cognitive traits (e.g. incongruent effect in Stroop)

_rami_ 1y ago
(Author here) Interesting! How do you differentiate between a bot and a screenreader user? Both won't move their mouse, scroll, etc but only send a single click event
- timshell 1y ago
  Yup, we had this with open-end analysis (see: https://www.producthunt.com/stories/how-to-detect-ai-content-with-keystroke-tracking https://www.producthunt.com/stories/how-to-detect-ai-content...) We had some people use voice software to fill in survey responses. This flagged computer-generated assistance. Generally speaking, it'll be more than a single click event (e.g. see https://x.com/_magrawal/status/1925985289568211168 https://x.com/_magrawal/status/1925985289568211168)
metladsl 1y ago
that's not entirely true. reCAPTCHA v3 relies on your Google account as a signal and what activities it has performed out in the wild. It's not exactly privacy-conscious, but certainly behavioral.
- timshell 1y ago
  Here's a GIF where reCAPTCHA v3 can't detect Operator: https://x.com/_magrawal/status/1925543620217905641 https://x.com/_magrawal/status/1925543620217905641 'Behavioral' is loosely defined, but it seems like the behavioral tells of Operator are quite simple
  - metladsl 1y ago
    bot protection, and specially sophisticated bot protection systems like recaptcha and shape security really kick in at scale. there'll be no obvious signs you're detected until you try to scale up your automations.

_rami_ 1y ago

(Author here) Interesting! How do you differentiate between a bot and a screenreader user? Both won't move their mouse, scroll, etc but only send a single click event

timshell 1y ago
Yup, we had this with open-end analysis (see: https://www.producthunt.com/stories/how-to-detect-ai-content-with-keystroke-tracking https://www.producthunt.com/stories/how-to-detect-ai-content...) We had some people use voice software to fill in survey responses. This flagged computer-generated assistance. Generally speaking, it'll be more than a single click event (e.g. see https://x.com/_magrawal/status/1925985289568211168 https://x.com/_magrawal/status/1925985289568211168)

metladsl 1y ago

that's not entirely true. reCAPTCHA v3 relies on your Google account as a signal and what activities it has performed out in the wild. It's not exactly privacy-conscious, but certainly behavioral.

timshell 1y ago
Here's a GIF where reCAPTCHA v3 can't detect Operator: https://x.com/_magrawal/status/1925543620217905641 https://x.com/_magrawal/status/1925543620217905641 'Behavioral' is loosely defined, but it seems like the behavioral tells of Operator are quite simple
- metladsl 1y ago
  bot protection, and specially sophisticated bot protection systems like recaptcha and shape security really kick in at scale. there'll be no obvious signs you're detected until you try to scale up your automations.