Turnstile is a browser check from a large network operator that watches how the browser behaves instead of asking the visitor to solve a picture puzzle.
A proof of work check takes another path: the browser spends computing effort, without building a profile of how the person behaves.
How it works
The operator looks at signals from the browser and the session to decide whether the visitor looks automated.
That design depends on observing the client rather than on a task the visitor can see and finish.
Privacy depends on what those signals include and who receives them.
If you want a check that does not watch behavior, a computational cost per attempt is a different tradeoff.
Concrete examples
- A sign in page shows a short automatic check instead of distorted letters.
- A visitor with an unusual browser is asked for more signals before the page continues.
- A scripted browser fails because it does not present the behavior the operator expects.
Protective measures
- Read what a third party browser check collects before you embed it.
- Offer a path that does not depend on watching browser behavior when privacy is a requirement.
- Keep rate limits on sensitive actions even after a challenge succeeds.
- Test the check with the browsers your customers actually use.
How CDPCaptcha helps
Proof of work raises the cost of scripted attempts to pass a browser check because every try must spend computing time before it can continue.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.