3 ms·

Here's a short explanation of spider.io's approach that might interest you: https://www.youtube.com/watch?v=RSWhvNdjAAE https://www.youtube.com/watch?v=RSWhvNdj

• thibauts 12y ago
  Ok so the library performs a kind of timing attack to detect whether it runs in a legitimate browser or not, and phones home { bot: true }. I make a bot that detects the script on the page and sends { bot: false }. You could try to obfuscate the signal by sending the raw collected browser behavior data but I still could reverse engineer its format or replay data from a legitimate session. I still don't understand how this could possibily work.