It does not capture the actual keys being pressed, according to the company. It studies the timing and rhythm instead.
That is addressed in the article. Because it’s JavaScript, we can verify this, and I’m sure that people will be scrutinising every revision of the code to check.
Because it’s JavaScript, we can verify this, and I’m sure that people will be scrutinising every revision of the code to check.
Have you ever seen obfuscated JS? I’m not saying it’s impossible, but de-transpiling it into something for a human then analyzing it is not trivial work.
Don’t bet on something not being terrible just because someone with the skill could maybe spend a lot of time doing the work.
Deobfuscators are fairly good IME. I haven’t checked this code in particular, but I’ve never seen obfuscated JavaScript that was uninterpretable following deobfuscation
…and probably can tell what you’re typing.
That is addressed in the article. Because it’s JavaScript, we can verify this, and I’m sure that people will be scrutinising every revision of the code to check.
Have you ever seen obfuscated JS? I’m not saying it’s impossible, but de-transpiling it into something for a human then analyzing it is not trivial work.
Don’t bet on something not being terrible just because someone with the skill could maybe spend a lot of time doing the work.
Deobfuscators are fairly good IME. I haven’t checked this code in particular, but I’ve never seen obfuscated JavaScript that was uninterpretable following deobfuscation
Congrats on being awesome at code analysis. Have at it for everyone, then.
But you can tell what a person is typing by their timing and rhythm. I don’t have time right now, but there are articles on that.
True, people should search for “keystroke timing attacks”. It’s more effective if you include things like accelerometer data and audio.
We can see what Cloudflare’s code is measuring and reporting to find out if those attacks would be possible.