Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

21–30 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#21

Post by o-__-o »

jgrahamc wrote: post #20
thejosh wrote: post #12

Cloudflare is both a great thing and a terrible thing that has happened to the internet in recent years. Great in that they have a fantastic UI to add your site in, basically shielding the average user from attacks. Bad from a standpoint of that now only Google, Bing, and maybe other big search engines have the capabilities to actually crawl the internet now. I don't see us getting a massive innovation in search on t…

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

How does my startup crawl Cloudflare sites without paying a hefty fee to Cloudflare?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#22

Post by nabla9 »

thejosh wrote: post #12

Cloudflare is both a great thing and a terrible thing that has happened to the internet in recent years. Great in that they have a fantastic UI to add your site in, basically shielding the average user from attacks. Bad from a standpoint of that now only Google, Bing, and maybe other big search engines have the capabilities to actually crawl the internet now. I don't see us getting a massive innovation in search on t…

There was once cs professor who claimed that the internet does not scale around 2000. Either things choke up or you need huge investments into networks.

It turns out that he was right, sort of. The vanilla attach server into the internet, server-to-client IP-network is pretty much dead. It has been replaced with CDN's , private delivery networks, cache on top of cache. Cloudfare, Amazon, Google and MS are the connection points for the IP. Their internal network infrastructure transfer most of the data.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#23

Post by navanchauhan »

jgrahamc wrote: post #20
thejosh wrote: post #12

Cloudflare is both a great thing and a terrible thing that has happened to the internet in recent years. Great in that they have a fantastic UI to add your site in, basically shielding the average user from attacks. Bad from a standpoint of that now only Google, Bing, and maybe other big search engines have the capabilities to actually crawl the internet now. I don't see us getting a massive innovation in search on t…

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

Crawling a Cloudflare powered website is basically impossible without needing to do some bodges as to how to crawl it.

How can you expect someone to crawl a bunch of websites if they are actively blocked from accessing it? Now, you might say users can whitelist bots in their robots.txt file but then again will the person creating the engine individually ask companies to allow them to crawl?

Also, slightly unrelated but Cloudflare protected websites are almost impossible to access via tor, the captcha never succeeds.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#24

Post by jgrahamc »

navanchauhan wrote: post #23
jgrahamc wrote: post #20

Earlier quoted context omitted.

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

Crawling a Cloudflare powered website is basically impossible without needing to do some bodges as to how to crawl it. How can you expect someone to crawl a bunch of websites if they are actively blocked from accessing it? Now, you might say users can whitelist bots in their robots.txt file but then again will the person creating the engine individually ask companies to allow them to crawl? Also, slightly unrelated b…

If you are building a search engine and getting blocked you can always contact me and I'll make sure that the teams that work on bot detection and DDoS are aware. We would like to know because we should not be blocking a legit crawler like this.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#26

Post by livre »

kylehotchkiss wrote: post #7

I’d rather take these tradeoffs than doing 5 steps of Recaptcha because I’m using a VPN to work, which as Cloudflares announcement said, is very localized to North America and likely extra complicated for those outside the region. In theory, couldn’t Yubikey begin reducing batch sizes to 1,000 and Cloudflare mark specific batch numbers as requiring one extra step to verify? The vast majority of Yubikey sales will be…

Wouldn't reducing batch sizes make privacy even more of a problem? Now instead of a 1/100000 chance of the user being the same person on another website there would be a 1/1000 chance.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#27

Post by md_ »

kylehotchkiss wrote: post #7

I’d rather take these tradeoffs than doing 5 steps of Recaptcha because I’m using a VPN to work, which as Cloudflares announcement said, is very localized to North America and likely extra complicated for those outside the region. In theory, couldn’t Yubikey begin reducing batch sizes to 1,000 and Cloudflare mark specific batch numbers as requiring one extra step to verify? The vast majority of Yubikey sales will be…

The batch size requirement is imposed by the FIDO spec, to ensure that batch IDs are not so high entropy as to pose a privacy problem.

"In this Full Basic Attestation model, a large number of authenticators must share the same Attestation certificate and Attestation Private Key in order to provide non-linkability (see Protocol Core Design Considerations). Authenticators can only be identified on a production batch level or an AAID level by their Attestation Certificate, and not individually. A large number of authenticators sharing the same Attestation Certificate provides better privacy, but also makes the related private key a more attractive attack target."

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#28

Post by jgrahamc »

o-__-o wrote: post #21
jgrahamc wrote: post #20

Earlier quoted context omitted.

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

How does my startup crawl Cloudflare sites without paying a hefty fee to Cloudflare?

https://news.ycombinator.com/item?id=27153635

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#29

Post by SXX »

jgrahamc wrote: post #20
thejosh wrote: post #12

Cloudflare is both a great thing and a terrible thing that has happened to the internet in recent years. Great in that they have a fantastic UI to add your site in, basically shielding the average user from attacks. Bad from a standpoint of that now only Google, Bing, and maybe other big search engines have the capabilities to actually crawl the internet now. I don't see us getting a massive innovation in search on t…

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

For instance there is no way for distributed search engines to work with CloudFlare. No, "contact me and we'll help" is not always a solution.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#30

Post by md_ »

rvz wrote: post #9

How does this so called 'CAPTCHA replacement' idea compare to Sign In With Apple? which also does not use any CAPTCHAs and aims to prevent bot sign ups.

Apple Sign-In is just an OpenID federated login; these don't inherently provide any anti-automation or rate limiting; they just push the problem to the Identity Provider.

IdPs like Apple/Google/Microsoft might do a fine job of limiting you to "one account per $unit-of-hardware"; Apple in particular can do this via iOS attestation. But then you're limited to either their heuristics (in the case of MSFT/Google) or their hardware (in the case of Apple).

Ultimately this is apples-to-oranges, though, since Cloudflare is not offering an IdP product but simply an anti-automation solution. If you use federated auth, you're getting (and giving up) a lot of other stuff beyond just anti-automation.

Post reply on HN