IT company Cloudflare, on September 28, announced its product Turnstile in a blog post as an alternative to Completely Automated Public Turing Test to Tell Computers and Humans Apart – commonly called CAPTCHA. According to Cloudflare, Turnstile not only saves and provides a better user experience but also enhances data privacy.
The term CAPTCHA was coined in 2000 by Luis von Ahn, Manuel Blum, Nicholas Hopper and John Langford of Carnegie Mellon University. It is a program that protects websites against bots.
If you are a frequent user of the internet, there is very little possibility that you might have missed CAPTCHA — those curvy, distorted letters and numbers that you need to identify and type in before you book a railway ticket, or those fire hydrants, boats, aeroplanes or bicycles you have to select from grids before moving forward on a website are all forms of CAPTCHA that make sure that the user accessing the website is a human and not a bot.
Why Turnstile?
Cloudflare claims that, unlike CAPTCHA, Turnstile uses “non-intrusive browser challenges”, chosen from a rotating suite. These challenges are based on telemetry (automatic collection and transmission of data remotely, for monitoring) and client behaviour exhibited during a session, rather than cookies like the login cookie.
In June 2022, the company announced the use of Private Access Tokens for some operating systems (OS), including recent versions of macOS and iOS. Users can prove that they are humans without completing CAPTCHA if they are on an OS that supports Private Access Tokens.
Private Access Tokens work on the principle of asking the device manufacturer to take care of parts of the validation process since they already possess part of the data required to validate device, thus not interrogating a device directly. These Private Access Tokens are built into Turnstile. It has to look at some parts of session data, like headers, user agent, and browser characteristics, to validate users, but Private Access Tokens minimise the amount of data collected (in cases of macOS and iOS, it asks Apple to validate the device).
Turnstile also includes machine learning (ML) models that detect common features among visitors who have previously passed a challenge, Cloudflare said.
