Leading CDN provider Cloudflare has released Turnstile, a free alternative to the “terrible user experience” currently offered by CAPTCHA services used by websites to verify authentic users online.
Announcing Turnstile in a blog post (opens in new tab), the company claimed its CAPTCHA alternative would also increase user privacy on the web, as sites using it won’t have to provide user data to Cloudflare.
Cloudflare’s CAPTCHA replacement will use Private Access Tokens, which allow users on supported operating systems to have their humanity proved for them “without completing a CAPTCHA or giving up personal data”. The company had previously announced in June 2022 (opens in new tab) that iOS and macOS devices would be the first to benefit from the tech when visiting sites hosted on Cloudflare’s network.
Eliminating CAPTCHA
Cloudflare says it has already reduced the number of CAPTCHAs users seen online by 91% using a Managed Challenge platform (opens in new tab) that draws more data from a web browser before deciding whether or not to serve up a CAPTCHA puzzle.
Turnstile opens this platform up to any website owner who wishes to use it. Migrating from an existing CAPTCHA system – like Google’s reCAPTCHA, which currently enjoys a 98% market share (opens in new tab) – is as simple as creating a Cloudflare account and swapping out HTML code.
On the face of it, Turnstile is a fairer CAPTCHA system for several reasons.
For website owners, it offers an alternative to Google’s stranglehold on CAPTCHA services, although this won’t impact Google’s staggering popularity as a search engine, where it is free to use its reCAPTCHA tech to verify users.
For users, Cloudflare claims that Turnstile sidesteps a severe privacy violation that security researchers say Google commits with the latest version of reCAPTCHA – weighing the presence of a proprietary cookie in a browser while deciding if a user is malicious or not. It accuses Google of passing the collected data to their ad sales business, although Google has denied this.
Cookies weighting verification may cause headaches for users who are using firewalls to protect against cookie hijacking attacks, whereby malicious threat actors attempt to use cookies to gain access to web applications. Users who simply delete their cookies regularly to avoid being tracked across the internet also face difficulty using reCAPTCHA.
Allowing operating systems to help verify users before users are served up CAPTCHA puzzles should also just make the online browsing experience far less grating going forward.
Being a privacy-focused solution aimed at improving user experience, it’s hard to see Cloudflare’s Turnstile as anything but a good thing right now.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba