Turnstile + Velocity Tracking: Defense-in-Depth Strategy

Mindful Auth implements two complementary security layers to protect against both automated and sophisticated attacks:

1. Turnstile (Frontend) - Cloudflare’s bot detection that stops 95%+ of automated attacks
2. Velocity Tracking (Backend) - Behavioral analysis that catches human-assisted and distributed attacks

This document explains why both layers are necessary and how they work together to provide enterprise-grade security.

---

What Turnstile Protects Against (95%+ of Attacks)

✅ Automated scripts - Bots, credential stuffing tools, automated form submissions
✅ Headless browsers - Selenium, Puppeteer, Playwright without proper humanization
✅ Known bad actors - IPs/networks with poor reputation scores
✅ Low-effort attacks - Script kiddies running basic attack tools

How it works: Turnstile analyzes browser behavior, device fingerprints, and network reputation to distinguish humans from bots. Most legitimate users never see a challenge (invisible mode).

---

What Turnstile Can’t Fully Prevent

1. Human-Assisted Attacks (Turnstile sees valid human requests)

CAPTCHA solving services ($1-3 per 1000 solves) - Real humans in click farms solve challenges for attackers.

Example Attack:

• Attacker pays $0.003 to solve Turnstile
• Submits 5 magic link requests for victim@example.com before token expires
• Turnstile perspective: 1 valid human solve ✅
• Velocity tracking perspective: 5 requests from 5 different IPs = harassment pattern 🚨

Manual attacks - Determined attacker manually solves Turnstile, then submits 50+ requests across different sessions.

Social engineering - Tricking legitimate users into submitting forms repeatedly (e.g., “Help me test my site by clicking this 20 times”).

---

2. Distributed Attacks from Multiple Legitimate Sources

Compromised accounts - Attacker uses stolen credentials from real users’ browsers (Turnstile passes because it’s a real browser with real user session).

Botnet with human browsers - Infected devices with real browsers solving challenges automatically using stored user profiles.

VPN rotation attacks:

• Attacker solves Turnstile on IP 1, submits request
• Switches to VPN IP 2, solves Turnstile again, submits request
• Repeats across 20 IPs

Example:

• Attacker uses 15 different VPN IPs
• Solves Turnstile on each (15 valid human verifications)
• Attempts login for victim@example.com on all IPs
• Turnstile: 15 valid human requests ✅
• Velocity tracking: Critical - distributed attack detected at 5th IP 🚨

---

3. Sophisticated Bots (Small percentage pass Turnstile)

Browser fingerprinting evasion - Advanced bots that perfectly mimic real browser behavior, including:

• Mouse movements and timing
• JavaScript execution patterns
• Canvas fingerprinting
• WebGL rendering

Residential proxy networks - Bots using home IP addresses with good reputation (not datacenter IPs).

Turnstile bypass techniques - Constantly evolving methods to circumvent bot detection.

Industry reality: Even the best CAPTCHA systems have a 2-5% bypass rate for sophisticated actors with sufficient resources.

---

4. Abuse After Valid Authentication

Insider threats - Legitimate users (or ex-employees) abusing the system from authenticated sessions.

Token timing attacks - Reusing valid Turnstile tokens at high frequency before expiration (tokens typically valid for 5 minutes).

Coordinated legitimate users - Multiple real users coordinated to spam a target (e.g., brigade attacks).

---

Defense-in-Depth: How They Work Together

Layer	Purpose	Detection Method	Stops What	False Positives
Turnstile	”Is this a bot?”	Browser behavior, fingerprints, reputation	95%+ automated attacks	Very low (~0.1%)
Velocity Tracking	”Is this abuse?”	Cross-request patterns, IP velocity, geo-anomalies	Human-assisted, distributed, sophisticated attacks	Very low (non-blocking design)

Complementary Strengths

Turnstile strengths:

• Real-time per-request validation
• Excellent at detecting automation
• Minimal UX friction (invisible for most users)
• Cloudflare’s massive threat intelligence network

Turnstile weaknesses:

• Can’t detect patterns across multiple requests
• Vulnerable to CAPTCHA solving services
• Can’t distinguish “legitimate but abusive” from “legitimate and safe”
• No historical context

Velocity tracking strengths:

• Analyzes patterns across time and IPs
• Detects distributed attacks from “legitimate” sources
• Catches human-assisted attacks
• Progressive penalties for repeat offenders
• Geo-anomaly detection (impossible travel)

Velocity tracking weaknesses:

• Can’t detect single bot requests (needs Turnstile for that)
• Relies on behavioral patterns (needs multiple requests to trigger)

---

Real-World Attack Scenarios

Scenario A: Basic Bot Attack (Stopped by Turnstile)

Attack: Script kiddie uses automated credential stuffing tool.

System Response:

1. Request hits Turnstile
2. No valid browser fingerprint detected
3. BLOCKED - Returns 403 before reaching backend
4. Velocity tracking never triggered (attack stopped at Layer 1)

Result: ✅ Stopped by Turnstile alone

---

Scenario B: CAPTCHA Solving Service Attack (Stopped by Velocity)

Attack: Professional attacker uses 2Captcha service to bypass Turnstile, then spams magic link requests.

Without Velocity Tracking:

1. Attacker pays $3 for 1,000 CAPTCHA solves
2. Rotates through 20 IPs, solves Turnstile on each
3. Submits 100 magic link requests for victim@example.com
4. Turnstile: ✅ All valid (real humans solved challenges)
5. Result: Victim receives 100 spam emails

With Velocity Tracking:

1. Attacker pays $3 for 1,000 CAPTCHA solves
2. Rotates through 20 IPs, solves Turnstile on each
3. First 4 IPs: Requests go through (Turnstile valid, velocity low)
4. 5th IP: BLOCKED by velocity tracking (harassment pattern detected)
5. Remaining 996 CAPTCHA solves wasted
6. Result: ✅ Victim receives max 4 emails, attacker wasted $2.98

---

Scenario C: Distributed Credential Stuffing (Stopped by Velocity)

Attack: Botnet with 100 residential proxies attempts credential stuffing (leaked password database).

Layer 1 - Turnstile:

• 95 bots blocked immediately
• 5 sophisticated bots pass Turnstile (2-5% bypass rate)

Layer 2 - Velocity Tracking:

• 5 bots spread across 5 different IPs attempt login for victim@example.com
• Velocity tracking detects pattern: 5 IPs in 2 minutes
• Account locked for 30 minutes
• Result: ✅ Attack stopped at Layer 2

Without velocity tracking: Those 5 sophisticated bots would continue attempting passwords until standard rate limit hit (after 3 failed attempts per IP = 15 total attempts).

---

Scenario D: Manual VPN Rotation Attack (Stopped by Velocity)

Attack: Determined human attacker manually solves Turnstile, switches VPN, repeats.

System Response:

1. Attacker on VPN IP 1: Solves Turnstile, requests magic link (success)
2. Attacker on VPN IP 2: Solves Turnstile, requests magic link (success)
3. Attacker on VPN IP 3: Solves Turnstile, requests magic link (success)
4. Attacker on VPN IP 4: Solves Turnstile, requests magic link (success)
5. Attacker on VPN IP 5: Solves Turnstile, BLOCKED by velocity tracking

Turnstile: All valid human interactions
Velocity tracking: 🚨 5+ IPs requesting magic links for same email = harassment attack

Result: ✅ Attack stopped after 4 emails sent (acceptable), attacker frustrated and gives up

---

Cost-Benefit Analysis for Attackers

Attack Type	Without Velocity Tracking	With Velocity Tracking	Attacker Cost
Script automation	❌ Blocked by Turnstile	❌ Blocked by Turnstile	$0 (free tools)
Manual spam (1 IP)	⚠️ Limited by per-email cooldown	✅ Blocked by IP limit (10/hour)	$0 (manual labor)
CAPTCHA service (10 IPs)	✅ Succeeds ($0.03)	❌ Blocked at 5th IP ($0.015 wasted)	$0.015 wasted
CAPTCHA service (100 IPs)	✅ Succeeds ($0.30)	❌ Blocked at 5th IP ($0.285 wasted)	$0.285 wasted
Residential botnet	⚠️ Partially succeeds	❌ Blocked at velocity threshold	High (botnet rental)

Key insight: Velocity tracking makes distributed attacks economically unfeasible by drastically increasing the cost-to-success ratio. Attackers waste 95% of their CAPTCHA solving budget and get only 4-5 successful requests.

---

Why Not Just Make Turnstile Stricter?

You might think: “Why not use Turnstile’s strictest ‘Always Challenge’ mode and skip velocity tracking?”

Approach A: Stricter Turnstile Alone

Configuration: Turnstile in ‘Always Challenge’ mode (visual CAPTCHA for every user)

Pros:

• Higher bot blocking rate (99%+)

Cons:

• ❌ Every legitimate user sees visual challenge (terrible UX)
• ❌ Still vulnerable to CAPTCHA solving services ($1-3 per 1000 solves)
• ❌ Still vulnerable to distributed attacks from real users
• ❌ Still vulnerable to VPN rotation attacks
• ❌ No protection against insider threats or coordinated abuse
• ❌ No progressive penalties for repeat offenders
• ❌ No geo-anomaly detection for account takeovers

Result: Worse UX, incomplete protection

---

Approach B: Balanced Turnstile + Velocity Tracking (Current Approach)

Configuration: Turnstile in ‘Managed’ mode (invisible for most users) + backend velocity tracking

Pros:

• ✅ 95% of legitimate users never see CAPTCHA (invisible mode)
• ✅ Blocks 95%+ of automated attacks (Turnstile Layer 1)
• ✅ Blocks human-assisted attacks (Velocity Layer 2)
• ✅ Blocks distributed attacks (Velocity Layer 2)
• ✅ Blocks VPN rotation attacks (Velocity Layer 2)
• ✅ Progressive penalties for repeat offenders (Velocity Layer 2)
• ✅ Geo-anomaly detection for account takeovers (Velocity Layer 3)
• ✅ Makes CAPTCHA bypass attacks economically unfeasible

Result: Best UX + Best Security = Best Practice

---

Industry Standards: Defense-in-Depth

Major platforms use the same layered approach:

GitHub

• Layer 1: Bot detection (similar to Turnstile)
• Layer 2: Rate limiting per IP
• Layer 3: Velocity tracking across IPs
• Layer 4: Behavioral analysis (login patterns, geo-anomalies)

Stripe

• Layer 1: Turnstile for public forms
• Layer 2: Rate limiting per API key
• Layer 3: Velocity scoring across merchants
• Layer 4: Machine learning fraud detection

AWS

• Layer 1: AWS WAF (bot protection)
• Layer 2: API rate limits
• Layer 3: GuardDuty (behavioral anomaly detection)
• Layer 4: Security Hub (cross-service analysis)

Mindful Auth’s approach matches enterprise standards used by platforms protecting millions of users and billions in transactions.

---

Security Architecture Diagram

┌─────────────────────────────────────────────────────────────┐
│  Attack Request (from attacker)                             │
└────────────────────────┬────────────────────────────────────┘
                         │
                         ▼
┌─────────────────────────────────────────────────────────────┐
│  Layer 1: Turnstile (Frontend Bot Detection)                │
│  ────────────────────────────────────────                   │
│  • Browser fingerprint analysis                             │
│  • Behavioral heuristics                                    │
│  • Network reputation check                                 │
│  • Challenge-response (if suspicious)                       │
│                                                              │
│  Blocks: 95%+ of automated attacks                          │
└────────────────────────┬────────────────────────────────────┘
                         │
                    ✅ Turnstile Pass
                    (or 2-5% sophisticated bypass)
                         │
                         ▼
┌─────────────────────────────────────────────────────────────┐
│  Layer 2: Velocity Tracking (Backend Behavioral Analysis)   │
│  ──────────────────────────────────────────────────         │
│  • IP velocity (unique IPs per email)                       │
│  • IP limits (requests per IP)                              │
│  • Progressive lockout (repeat offenders)                   │
│  • Geo-anomaly detection (impossible travel)                │
│                                                              │
│  Blocks: Human-assisted, distributed, sophisticated attacks │
└────────────────────────┬────────────────────────────────────┘
                         │
                    ✅ Velocity Pass
                         │
                         ▼
┌─────────────────────────────────────────────────────────────┐
│  Process Legitimate Request                                 │
│  (Login, Registration, Magic Link, etc.)                    │
└─────────────────────────────────────────────────────────────┘

---

Key Takeaways

1. Turnstile is essential - Blocks 95%+ of attacks with minimal UX friction
2. Velocity tracking is critical - Catches the 5% that bypass Turnstile + human-assisted attacks
3. Defense-in-depth is industry standard - Used by GitHub, Stripe, AWS, and all major platforms
4. Economic deterrence - Velocity tracking makes bypass attacks 95% more expensive for attackers
5. Best UX + Best Security - Invisible protection for legitimate users, multi-layer blocks for attackers

Mindful Auth provides enterprise-grade security that matches platforms protecting millions of users.