Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

41–50 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#41

Post by o-__-o »

jgrahamc wrote: post #36
o-__-o wrote: post #35

Earlier quoted context omitted.

This will scale wonderfully!

No, what scales is us making our DDoS and bot detection not disrupt the crawling of legit search engines that respect robots.txt, don't crawl at ridiculous speeds, don't do dumb stuff like pretend they are the Googlebot. We have teams who work on that. You can read more here: https://blog.cloudflare.com/tag/bots/ But let's suppose someone is building a new cool search engine and our ML stuff is blocking them. Then...…

So for my startup to crawl sites I must now adhere to Cloudflare’s Requirements of the Web(TM) or reach out to individual engineer, who may leave at any moment. Gotcha

(but Google is allowed because Google was first to market)

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#42

Post by jgrahamc »

oefrha wrote: post #38
jgrahamc wrote: post #24

Earlier quoted context omitted.

If you are building a search engine and getting blocked you can always contact me and I'll make sure that the teams that work on bot detection and DDoS are aware. We would like to know because we should not be blocking a legit crawler like this.

Say I’m interested in building a small scale domain-specific search engine and only just started development. There’s no prototype yet and may never be. In this situation, how do you determine it’s a legit crawler? And what about crawlers with even more limited scopes (targeting only a handful of sites) that they can’t possibly be called search engines? Are they ever considered legit?

Be a good netizen? Respect robots.txt. Don't lie in your User-Agent. Don't crawl at a ridiculous rate. All those are a good starting point.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#43

Post by jgrahamc »

catillac wrote: post #40
jgrahamc wrote: post #31

Earlier quoted context omitted.

Please explain the problem (here or via email to me).

I’m really sorry, but you appear to be the CTO of Cloudflare, which makes your not knowing the ins and outs of the problem already and basic questioning of it seem like sealioning.[1] [1] https://en.m.wikipedia.org/wiki/Sealioning

I do not understand what the parent means by a "distributed search engine" and I do not know what problem they are facing.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#44

Post by dboreham »

Nextgrid wrote: post #6
arsome wrote: post #5

Earlier quoted context omitted.

I believe the idea here is you need to buy actual FIDO U2F keys and they could then be revoked on a per-key basis if you're caught abusing them as they're signed by a 3rd party so can't just be emulated. Meaning you need to buy more. Makes it expensive at least.

How can you revoke on a per-key basis without at the same time being able to track keys uniquely?

You can't. The device attestation protocol specifically excludes the ability to uniquely identify devices (the key has to be re-used in at least 99999 other devices).

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#45

Post by PaulHoule »

SXX wrote: post #29
jgrahamc wrote: post #20

Earlier quoted context omitted.

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

For instance there is no way for distributed search engines to work with CloudFlare. No, "contact me and we'll help" is not always a solution.

I've never been able to "reach a human" at Google, Facebook and other web giants and I'm skeptical that you can at a place like Cloudflare. In fact, I'd be really astonished it was possible, because otherwise their business isn't scalable.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#46

Post by viraptor »

Even if we ignore the technical reasons, for me CloudFlare's proposal fails at their "Associate a unique ID to your key" property, where they say CloudFlare could, but won't do it. If they implement this scheme they start normalising this approach. Once it gets to FB and Google implementation, their answer will be: we could, but we... look! a squirrel!

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#47

Post by dboreham »

y7 wrote: post #39
Nextgrid wrote: post #6

Earlier quoted context omitted.

How can you revoke on a per-key basis without at the same time being able to track keys uniquely?

Yup, you can't. Keys are perfectly trackable by Cloudflare, but they promise they won't do this. Edit: I was wrong. Cloudflare claims they could track people, but it would require tracking via cookies. [1] The hardware security keys have an "attestation key pair" that is shared among all units in one production batch (which contains at least 100K units). [2] 1: https://blog.cloudflare.com/introducing-cryptographic-at…

No, they can't do this. It's the U2F key vendor that promises not to release a device-unique key to someone like CF.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#48

Post by viraptor »

jgrahamc wrote: post #43
catillac wrote: post #40

Earlier quoted context omitted.

I’m really sorry, but you appear to be the CTO of Cloudflare, which makes your not knowing the ins and outs of the problem already and basic questioning of it seem like sealioning.[1] [1] https://en.m.wikipedia.org/wiki/Sealioning

I do not understand what the parent means by a "distributed search engine" and I do not know what problem they are facing.

https://yacy.net/ for example. Each interested node does indexing and serving some chunk of the results.

Or in practice - each node quickly runs into a CloudFlare captcha preventing it from indexing content for a few hours/days. Since CF fronts a lot of the useful internet these days, it means it's effectively working against distributed indexing with its current captcha solution.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#49

Post by joepie91_ »

jgrahamc wrote: post #43
catillac wrote: post #40

Earlier quoted context omitted.

I’m really sorry, but you appear to be the CTO of Cloudflare, which makes your not knowing the ins and outs of the problem already and basic questioning of it seem like sealioning.[1] [1] https://en.m.wikipedia.org/wiki/Sealioning

I do not understand what the parent means by a "distributed search engine" and I do not know what problem they are facing.

A search engine which is not run centrally by one organization on infrastructure in a known network, but rather something like YaCy where individual users run crawler nodes on networks that vary over time.

Which makes "contact us for an exception" a no-go, as the relevant source IPs will constantly be changing.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#50

Post by jgrahamc »

viraptor wrote: post #48
jgrahamc wrote: post #43

Earlier quoted context omitted.

I do not understand what the parent means by a "distributed search engine" and I do not know what problem they are facing.

https://yacy.net/ for example. Each interested node does indexing and serving some chunk of the results. Or in practice - each node quickly runs into a CloudFlare captcha preventing it from indexing content for a few hours/days. Since CF fronts a lot of the useful internet these days, it means it's effectively working against distributed indexing with its current captcha solution.

Thanks. I'll bring this to the attention of the bots and DDoS teams.
Post reply on HN