> "Our discovery is that both Javascript and Flash will also tell you if there’s a real user behind that inferface,” Mr. Kaminsky said."

That isn't how that works. That isn't how any of it works.

Selenium + https://code.google.com/p/flash-selenium/ == Has both.

People who block flash & javascript for security reasons? Also blocks both.

The sheer ease of bypass and the rate of false positives for any sophisticated operator is going to be huge.

Maybe I'm overly skeptical but I don't see this filtering any bot operation that is sophisticated enough to run something like selenium.

EDIT: Folks, I'm aware Selenium is a terrible example but it was the first thing that came to mind.

There are plenty of other headless toolkits that are easier to weaponize. Maybe I didn't want to point that out by linking to them/mentioning them? :|