Top all-time · #9401
The Castle blog
Company blog · blog.castle.iosecurityai
The Castle blog is the company blog at blog.castle.io, writing about security and ai. Since 2025, 8 different Hacker News readers have linked it 39 times, most often “What a Binance CAPTCHA solver tells us about today's bot threats”. It is still writing: the last post was on 2026-10-27, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link this bot-detection vendor's blog for technical posts on browser fingerprinting, anti-detect browser analysis, and how LinkedIn fingerprints browser extensions. Commenters cite them as sources.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Research and insights on stopping modern bots and fraud
Most-linked posts?
- What a Binance CAPTCHA solver tells us about today's bot threats3 people · 5 mentions · first linked 2025-05-20
- Detecting browser extensions for bot detection, lessons from LinkedIn and Castle2 people · 4 mentions · first linked 2026-01-14
- Anti-Detect Browser Analysis: How to Detect the Undetectable Browser?2 people · 2 mentions · first linked 2025-03-05
- Canvas Fingerprinting in the Wild2 people · 2 mentions · first linked 2025-01-06
- What TikTok's virtual machine tells us about modern bot defenses2 people · 2 mentions · first linked 2025-06-04
What Hacker News says?
>Test your browser: >coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point. Something to note - if a fingerprint is generic enough, that might be a _good_ thing! Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things like collecting more coarse fingerprints[0], as the overall one is fa…
Comment linking /fingerprints-beyond-device-ids-engineered-representations-for-fraud-detection/
on “Fingerprints are the new cookies”Submitted Detect and crash Chromium bots as a story · 146 points
HN discussionYeah, not (too) surprising after a few years in the anti-bot industry. Last week I looked into a Binance CAPTCHA solver that didn’t use a browser at all, just a basic HTTP client. The attacker had reverse engineered the entire signal collection and response flow, including how the CAPTCHA was marked as solved. They were able to forge the expected telemetry despite some obfuscation. https://blog.castle.io/what-a-bina…
Comment linking /what-a-binance-captcha-solver-tells-us-about-todays-bot-threats/
on “CAPTCHAs are over (in ticketing)”Submitted Detecting Noise in Canvas Fingerprinting as a story · 41 points
HN discussionReposting a similar point I made recently about CAPTCHA and scalpers, but it’s even more relevant for scrapers. PoW can help against basic scrapers or DDoS, but it won’t stop anyone serious. Last week I looked into a Binance CAPTCHA solver that didn’t use a browser at all, just a plain HTTP client. https://blog.castle.io/what-a-binance-captcha-solver-tells-u... The attacker had fully reverse engineered the signal co…
Comment linking /what-a-binance-captcha-solver-tells-us-about-todays-bot-threats/
on “A thought on JavaScript "proof of work" anti-scraper systems”Submitted How bot detection misfires on non-mainstream browsers and privacy tools as a story · 7 points
HN discussionI recently wrote about the limits of these kinds of fingerprinting tests. They tend to overly focus on uniqueness without taking into account stability. Moreover sample size is often really small which tends to artificially make a lot of users unique https://blog.castle.io/what-browser-fingerprinting-tests-lik...
Comment linking /what-browser-fingerprinting-tests-like-amiunique-and-browserleaks-really-show-and-what-they-miss/
on “Browser Fingerprint Detector”Submitted From Puppeteer stealth to Nodriver: How anti-detect frameworks evolved over time as a story · 6 points
HN discussionMost anti-bots will send other browser characteristics as well and can detect if one is lying about which browser, and even which version they're using based on which APIs and properties are/aren't available. see: https://blog.castle.io/anti-detect-browser-analysis-how-to-d...
Comment linking /anti-detect-browser-analysis-how-to-detect-the-undetectable-browser/
on “Cloudflare blocking Pale Moon and other browsers”Submitted What TikTok's virtual machine tells us about modern bot defenses as a story · 6 points
HN discussionI wrote a blog post recently about the technique used by LinkedIn to do extension probing, as well as other ways to do it with less side effects https://blog.castle.io/detecting-browser-extensions-for-bot-...
Comment linking /detecting-browser-extensions-for-bot-detection-lessons-from-linkedin-and-castle/
on “LinkedIn Is Fingerprinting the Browser Extensions”Submitted We detected a CAPTCHA solver in the wild, and what it says about bot defenses as a story · 5 points
HN discussionTechnical writeup from a few weeks ago by a vendor that explains how LinkedIn does it, then boasts that their approach is "quieter, harder to notice, and easier to run at scale": https://blog.castle.io/detecting-browser-extensions-for-bot-...
Comment linking /detecting-browser-extensions-for-bot-detection-lessons-from-linkedin-and-castle/
on “LinkedIn Is Fingerprinting the Browser Extensions”Submitted What a Binance CAPTCHA solver tells us about today's bot threats as a story · 5 points
HN discussionIsn't it enumerating web_accessible_resources? Below static collectFeatures(e, t) there is a mapping of extension IDs to files in the const r (Minified JS, obviously.) Edit: Confirmed. It's not pinging the Chrome Web Store. https://blog.castle.io/detecting-browser-extensions-for-bot-...
Comment linking /detecting-browser-extensions-for-bot-detection-lessons-from-linkedin-and-castle/
on “LinkedIn Is Fingerprinting the Browser Extensions”Submitted Bought sneaker proxies by mistake, did science with them anyway as a story · 4 points
HN discussionSubmitted What TikTok's virtual machine tells us about modern bot defenses as a story · 4 points
HN discussionSubmitted What a Binance CAPTCHA solver tells us about today's bot threats as a story · 4 points
HN discussionSubmitted Roll your own bot detection: fingerprinting/JavaScript as a story · 3 points
HN discussionSubmitted Why a classic CDP bot detection signal suddenly stopped working as a story · 3 points
HN discussionSubmitted Detecting Gmail-based fake accounts: what Emailnator teaches us as a story · 3 points
HN discussionSubmitted What a Binance CAPTCHA solver tells us about today's bot threats as a story · 3 points
HN discussionSubmitted How dare you trust the user agent for bot detection? as a story · 3 points
HN discussionSubmitted Canvas Fingerprinting in the Wild as a story · 3 points
HN discussionSubmitted Canvas Fingerprinting in the Wild as a story · 3 points
HN discussionSubmitted Inside a bot operator's email verification infrastructure as a story · 2 points
HN discussionSubmitted Detecting browser extensions for bot detection, lessons from LinkedIn and Castle as a story · 2 points
HN discussionSubmitted Finding links between fraudulent email domains using graph-based clustering as a story · 2 points
HN discussionSubmitted What browser fingerprinting tests like Amiunique show, and what they miss as a story · 2 points
HN discussionSubmitted Detecting Hidemium: Fingerprinting inconsistencies in anti-detect browsers as a story · 2 points
HN discussion