Second, we find that a few privacy-focused users often ask their browsers to go beyond standard practices to preserve their anonymity. This includes changing their user-agent (something bots will do to evade detection as well), and preventing third-party scripts from executing entirely. Issues caused by this behavior can now be displayed clearly in a Turnstile widget, so those users can immediately understand the issue and make a conscientious choice about whether they want to allow their browser to pass a challenge.

Those of you that browse the internet with JS disabled (e.g. using NoScript), the time of reckoning has finally come. A huge swatch of internet will no longer be accessible without enabling javascript.

I just tested my favourite cloudflare-blocked site and it still hangs on "verifying the security of your connection" in my figerprinting-resistant browser profile.

How does any of this fit into the reality that you can pay $1 per 1000 captchas for a real, actual human to solve them? It seems like so much effort is put into this cat&mouse narrative with bot makers, ignoring the reality that sometimes labour is actually much cheaper.

Bots definitely can check a box, and they can even mimic the erratic path of human mouse movement

Damn I didn't know that was being tracked too

Cloudflare MITMs a good portion of internet traffic. They can even see inside SSL tunnels for most websites you visit. It's an absolute privacy nightmare.

But how it works? I don't see any explanation on the post nor CF web site. It looks magical.