Great, except most bots don't use the API directly. They look like normal users to the server for the most part.

Google has spent billions trying to distinguish bots from users. And has been largely unsuccessful n

Seems like it would be relatively simple no? They control the app itself? Wouldn't it be trivial to put a signature to the app and see the typing speed, user actions, etc?

Google is doing that, you know all those "I am not a robot" things? Those are made by google mostly and uses a lot of such signals. Its not just clicking the right things its also how you click etc.

The reason some of those just have a checkbox without a challenge is that they already are sure enough so how you move to click the box is enough then.

This would be about as trivial as it'd be for YouTube to block yt-dlp.

Pretty useless because agents can reply per UI

The professional troll factories (that tend to get quiet when Russian office hours are done...) have used browser automation for years already - and they pay the $ whatever for the blue checkmark to get to the top of people's replies.

"Bots" have for a very long time now to a lot of people meant people who are following instructions/being paid to post/reply rather than only scripts.

"Bots" being actual humans in literal office buildings feeding and flaring up misinformation and dissent online.

They've upgraded to AI's recently though, usually the first response is a canned AI thing but if you keep arguing you'll get an actual human.