The simplicity of it is logic defying. It used to be that you had to find crosswalks or move puzzle pieces or type blurred letters and numbers, but NOW all the sudden I can just click a box and HEY!, I’m human?
That’s hardly the Turing Test I’d expected.
They look at your IP Address. They have a list of IP Addresses collected by
Primary sources, they host a lot of websites and can see your IP when you use them.
Secondary sources, when you allow yourself to be tracked by people such as Google.
If your IP does things not usually considered human, it gets flagged. Example Cases:
User A has had the same public IP for 5 years and usually just checks his email and watches YouTube. Likely human.
User B has rented a public IP from a VPN and spent the last 5 minutes making 300 varied API calls per second. Likely bot.
Cloudflare could just confirm you preemptively but that would be a violation of your privacy and deprive you the right to appeal by selecting every fire hydrant.