Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

151–160 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#151

Post by ehutch79 »

grishka wrote: post #148
ehutch79 wrote: post #146

Earlier quoted context omitted.

I don't think you understand why that captcha is there in the first place then. Cloudflare prevents a bunch of crap that site operators just don't want to deal with. Especially for smaller sites that are run by one person. Dealing with a wordpress site getting hacked because you missed an update by a day, or a bulletin bored getting swarmed with bots, or some asshat ddos'ing your site because you banned them. Suddenl…

Yeah, so centralizing the entire internet around a black box that sees all your traffic in cleartext is clearly the right solution. /s > Dealing with a wordpress site getting hacked because you missed an update by a day Maybe don't use something this vulnerable then and rely on a third party to protect you from exploits. > or a bulletin bored getting swarmed with bots Maybe require email verification and/or a captcha…

Monocultures are always bad, but I don't see any alternative services with this level of ease of use.

You're definitely overestimating the technical expertise/available time of a lot small time admins out there.

You don't see bots and spam on those forums either because they are actually using cloudflare, and you're just not seeing the captcha, or because in the backend they're feeding all their posts through akismet (in plain text). I don't think you're considering how many services see your posts, even when you don't trip a captcha.

email accounts are trivial to sign up for, especially for bots. I always recommend charging $1 (or local equivalent) for an account, that's a lot harder to fake.

My point in all this is that bitching that site is using cloudflare to not have to deal with crap, is a self centered view.

Saying "well it never happened to me, so it must never happen" is similarly self absorbed.

Maybe consider that your experience is not everyones experience

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#152

Post by wereHamster »

djoldman wrote: post #145

Can a FIDO key be implemented in software? Can you write a program to register a FIDO key as a multi-factor authentication device with a Google account? Or is there some repository of all allowed devices with identifiers? Intuitively that'd be the only way to prevent infinite virtual devices..

Yes. Example: https://github.com/github/SoftU2F

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#153

Post by ve55 »

The way I'd put it is that Cloudflare's suggested implementation may have its issues, but the general idea of trying to verify that someone is a human and then providing this verification to services in a way that is 1) anonymous and 2) cross-compatible with other services, is the correct way to go about things (or at least has some very appealing features).

I hope that we have something in the future that does this job very well so that services do not need to verify phone numbers, Google accounts, and even IDs and facial imagery just to allow someone to use them (as this is much easier to do than coming up with new captcha styles that humans can quickly and easily solve, but that basic machine learning and scripting cannot).

Being able to use the Internet with the slightest bit of privacy is already ~impossible for the average user and extremely difficult and tedious for very knowledgeable and experienced ones, so anything that tries to improve the current trend sounds like it's at least attacking a problem worthy of our attention.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#154

Post by floatboth »

djoldman wrote: post #145

Can a FIDO key be implemented in software? Can you write a program to register a FIDO key as a multi-factor authentication device with a Google account? Or is there some repository of all allowed devices with identifiers? Intuitively that'd be the only way to prevent infinite virtual devices..

Attestation (what they use) is orthogonal to authentication. Token manufacturers have per-batch keys, private key being in the devices of that batch, so sites can verify that your device is from that batch of that vendor. You "can" implement attestation with your own key in software or in whatever, but Cloudflare won't trust your key :D

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#155

Post by floatboth »

ehutch79 wrote: post #135
grishka wrote: post #132

Cloudflare captchas in particular, and any checks and roadblocks to see something publicly available in general, are terrible, period. It doesn't matter which form they take. Every time you see one you feel like a second-class citizen and get reminded that the internet is no longer what it used to be. I personally simply close the tab when I see a cloudflare "one more step" page.

How do you mitigate ddos attacks and other bad actors hitting a page? What does your cdn solution look like? Route optimization from your (single) endpoint to clients literally half a world away?

For regular public web pages, serving the actual fucking page should not be more expensive than serving the captcha page! What the hell is a "bad actor" in relation to GET requests to a public page? To a public page, all actors should be inherently neutral.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#156

Post by ignoramous »

danShumway wrote: post #65

Complete aside, but I'm still not certain I understand the technical details of why Cloudflare can't uniquely identify users. I thought I knew how hardware keys worked, but apparently I don't. If the key being shared is embedded in the device, even in a secure enclave or something, then my understanding was that would open the door for key extraction. If the key is unique per-device, then that's not a problem. But if…

> Where am I going wrong? I feel like I'm misunderstanding something fundamental about how signing works on these devices, but I can't figure out what it is.

Whilst Fast Identity Online (FIDO) is much more than WebAuthn, Cloudflare's proposal here is to use WebAuthn to get rid of CAPTCHAs. The official WebAuthn doc is surprisingly accessible with neat illustrations for key topics: https://w3c.github.io/webauthn/ (ref registration and authentication ceremonies, in particular)

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#157

Post by gjvr »

danShumway wrote: post #91
md_ wrote: post #81

Earlier quoted context omitted.

https://fidoalliance.org/fido-technotes-the-truth-about-atte... explains this pretty well. Basically: * Attestation keys are not unique per authenticator; they're shared among batches of authenticators. * If you extract the batch's attestation key, you can imitate authenticators from that batch. That doesn't mean you can authenticate as a registered authenticator, of course; it just means you can pretend to be a "Yub…

Thanks, that's really helpful. Followup questions though: - Does this mean if I buy 2 of these devices at the same time, it's possible for me to get the same attestation keys on both devices? I guess depends on how many batches at a time a company is producing. - Doesn't this mean that attestation keys will get more unique over time as devices from the pool fall out of circulation and become rarer? Are keys rotated t…

I understand from [0] that the attestation key is shared across all instances (SNs) of the same model (PN): "...For example, all YubiKey 4 devices would have the same attestation certificate; or all Samsung Galaxy S8’s would have the same attestation certificate". So you would not need to to buy them at the same time.

But of course, despite this, still a unique key is generated for each identity upon sign up [0]. I am not sure (as in 'have no knowledge of') the entropy for these devices.

[0] https://fidoalliance.org/fido-technotes-the-truth-about-atte...

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#158

Post by gsich »

ehutch79 wrote: post #147
grishka wrote: post #143

Earlier quoted context omitted.

As I user, I simply don't care. I repeatedly get punished for doing nothing wrong. It's almost like airport security. > What does your cdn solution look like? > Route optimization from your (single) endpoint to clients literally half a world away? And as a developer, I don't understand this newfangled obsession over CDNs either. Yes, there will be 200 ms RTT in some cases. So what? Get over it. Optimize your website…

that 200ms rtt does matter to users. it becomes very noticeable. especially when you're writing an app, not a brochure site. You need to tree shake so you're not serving a huge spa all at once. I've see much worse times for users, and a cdn absolutely help with our staff in asia dealing with our internal apps. Of course they're not always tripping up cloudflare and being shown captchas. I almost _never_ see a cloudfl…

What use has an app that requires a full RTT fot every buttonpress?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#160

Post by anothergram »

ve55 wrote: post #153

The way I'd put it is that Cloudflare's suggested implementation may have its issues, but the general idea of trying to verify that someone is a human and then providing this verification to services in a way that is 1) anonymous and 2) cross-compatible with other services, is the correct way to go about things (or at least has some very appealing features). I hope that we have something in the future that does this…

Alternatively, if services demand a fee then there is no need for human verification.

Instead of trying to solve anonymous human verification we can as well make micro-payment an option.

Post reply on HN