Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

211–220 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#211

Post by jjav »

ehutch79 wrote: post #135
grishka wrote: post #132

Cloudflare captchas in particular, and any checks and roadblocks to see something publicly available in general, are terrible, period. It doesn't matter which form they take. Every time you see one you feel like a second-class citizen and get reminded that the internet is no longer what it used to be. I personally simply close the tab when I see a cloudflare "one more step" page.

How do you mitigate ddos attacks and other bad actors hitting a page? What does your cdn solution look like? Route optimization from your (single) endpoint to clients literally half a world away?

> How do you mitigate ddos attacks and other bad actors hitting a page?

Not sure what "bad actors hitting a page" even means. I host public info so people can see it, be it good or "bad" people. Let them see it.

DDoS is different and can be devastating of course. Also, very rare. In decades hosting content (started my first hosting business in 1994) I've never experienced anything remotely like a DDos. I know it happens, but definitely very rare for most people. Driving tons of legitimate users away with relentless captcha annoyances for the once in a liftime possibility of a DDoS is not a good tradeoff.

If you're in a business that attracts DDoS like flies then deal with that, otherwise lay off the captchas.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#212

Post by dragonwriter »

CogitoCogito wrote: post #210
Animats wrote: post #207

Once they have your ID info, they'll later change the terms to sell it to advertisers. Are they contractually committing to never doing that? No. So they will.

Even if they are contractually committed not to sell your info, that still might not save you: “Yesterday, the bankruptcy court approved the sale over the objections of several parties, including the Federal Trade Commission (FTC) and third party manufacturers Apple and AT&T who sold products to the bankrupt retailers. ... The FTC’s objection was made to the court-appointed consumer privacy ombudsman in the RadioShac…

> In that case the judge allowed the sale of the information in contradiction to its commitments.

Note that bankruptcy always allows things in contradiction to commitments; bankruptcy is all about balancing which commitments will not be fulfilled, and by how much, when a party is no longer capable of fulfilling all of its commitments.

If you don’t like particular commitments being voided in bankruptcy, you want legislation specifically protecting them so that there is a clear legal barrier to voiding those specific kinds of obligations.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#213

Post by bayindirh »

grishka wrote: post #200
bayindirh wrote: post #198

Earlier quoted context omitted.

> Well, it does say 130 ms in here. If you have a fiber backed, all-switched network with no routing, buffers, congestions, or detours, you may get that value, if you're lucky . Pinging tty.sdf.org which is a direct access shell service in USA from somewhere between Europe and Asia, from an academic network backbone roundtrips in ~190ms. I'm traversing a little less than half a globe with the whole journey. In your t…

> Pinging tty.sdf.org which is a direct access shell service in USA from somewhere between Europe and Asia, from an academic network backbone roundtrips in ~190ms. Actually I get around 200 from Russia which is also "somewhere between Europe and Asia": round-trip min/avg/max/stddev = 196.504/197.581/199.833/1.360 ms > By using Cloudflare workers, so your code is also distributed around the globe? Great, let's give th…

> Great, let's give that company even more control. That's sure gonna end well.

We have enough evil companies who invade our lives through the platform develop. Cloudflare is not one of them. Using them is voluntary (by the service providers), and I think they're one of the more useful companies around.

BTW, I'm not a web developer or Cloudflare employee. I have no skin in this stuff, however they build some cool stuff inside the Linux kernel, which is interesting from my PoV.

> It all gets loaded once and then cached in the browser.

Then cleared and/or invalidated by the user or browser's logic itself due to plethora of reasons.

> The initial load takes long regardless of whether there's a CDN.

Actually, no. A reasonably fast internet connection (>12 Mbps we can say) can load a lot of things very very fast. The biggest overhead is DNS, even with CDNs. With a good local, network-wide DNSMasq installation, if the server is close, I can load big sites almost instantly.

> And, it doesn't matter whether a JS file loads in 50 ms or 300 ms, if it then takes 5 seconds to parse and start running.

I think 5 seconds is long time for even the old Netscape Navigator's JS parser. You need to run something akin skynet to parse the JS file for straight 5 seconds. How's that even possible?

> So put them on a separate domain and serve that from a CDN if you really care whether that stock photo no one notices loads in 500 ms instead of 2000.

I don't know you, but world news generally contains live/new footage or fresh photos from the ground, not some stock photos, also we humans are visual animals. Many people want to see the images first, read the text later.

> That doesn't explain much why anyone would put their main domain behind cloudflare.

Load balancing, DDoS protection, CDN, workers, Bot/Scraping protection, cost reduction, rate limiting, you name it. Even my DSL router implements some of the protections, to my surprise.

Internet is not the same beast now when compared to 90s/00s. I miss the simpler times, but alas.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#214

Post by jjav »

ehutch79 wrote: post #151
grishka wrote: post #148

Earlier quoted context omitted.

Yeah, so centralizing the entire internet around a black box that sees all your traffic in cleartext is clearly the right solution. /s > Dealing with a wordpress site getting hacked because you missed an update by a day Maybe don't use something this vulnerable then and rely on a third party to protect you from exploits. > or a bulletin bored getting swarmed with bots Maybe require email verification and/or a captcha…

Monocultures are always bad, but I don't see any alternative services with this level of ease of use. You're definitely overestimating the technical expertise/available time of a lot small time admins out there. You don't see bots and spam on those forums either because they are actually using cloudflare, and you're just not seeing the captcha, or because in the backend they're feeding all their posts through akismet…

> My point in all this is that bitching that site is using cloudflare to not have to deal with crap, is a self centered view.

Who is serving whom here?

If a business thinks it's ok to impose cloudflare inconvenience on me, the customer, for the priviledge of giving them my money, who is self centered here?

The simple answer is I'll close the tab and go buy it from a competitor. I'm not playing captcha games to buy something.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#215

Post by poisonborz »

AtNightWeCode wrote: post #172

There are a lot services in Sweden that requires that you provide a real authentication by using something called BankId. Basically a personal digital id. This is the way to go. 100% secure validated users. If there was a function added to make the users anonymous to third party services it would be great. I work with Cloudflare sites and it is clear that thier current enterprise offerings are hard to tweak to solve…

Ah yeah, instantly zeroing anonimity for most users, while it can be still abused by malicious actors, a great worst of both worlds solution.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#216

Post by TimWolla »

ignoramous wrote: post #112
wfleming wrote: post #93

Earlier quoted context omitted.

Each key is associated with a batch of devices, though. If you ban a key, you risk banning a bunch of legitimate users. It's an interesting trade-off. It seems like batch keys for device attestation was designed to help protect individual privacy (good), but if you can't ban a key without potentially a lot of splash damage when you detect a bad actor, that seems like a very limiting choice.

> Each key is associated with a batch of devices, though. If you ban a key, you risk banning a bunch of legitimate users. You're right. I meant Cloudflare could ban the generated public-key and not the device's public-key itself. Besides, they could also mark the batch as being taken over by bots and increase the level on challenges issued to the batch. Note though, a single secure module can only generate / store so…

> For instance, Yubi Key 5 supports up to 25 keys

This is for resident keys. A YubiKey 5 supports an infinite number of non-resident WebAuthn keys, because the returned key handle will simply be the private key encrypted with a master key stored on the YubiKey. For authentication the service will send the stored key handle back to the YubiKey which then can decrypt it and use the decrypted private key to sign the challenge.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#218

Post by johnklos »

nabla9 wrote: post #22
thejosh wrote: post #12

Cloudflare is both a great thing and a terrible thing that has happened to the internet in recent years. Great in that they have a fantastic UI to add your site in, basically shielding the average user from attacks. Bad from a standpoint of that now only Google, Bing, and maybe other big search engines have the capabilities to actually crawl the internet now. I don't see us getting a massive innovation in search on t…

There was once cs professor who claimed that the internet does not scale around 2000. Either things choke up or you need huge investments into networks. It turns out that he was right, sort of. The vanilla attach server into the internet, server-to-client IP-network is pretty much dead. It has been replaced with CDN's , private delivery networks, cache on top of cache. Cloudfare, Amazon, Google and MS are the connect…

No. The marketing of all that extra crap has gotten better.

It's just like Windows - just because 95% of the Internet does something one way doesn't mean it doesn't suck, isn't more complicated than it needs to be, and doesn't cost more than it needs to cost.

Anyone with a little bit of bandwidth and a Raspberry Pi can run a web server, even with dynamic content.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#219

Post by [deleted] »

grishka wrote: post #143
ehutch79 wrote: post #135

Earlier quoted context omitted.

How do you mitigate ddos attacks and other bad actors hitting a page? What does your cdn solution look like? Route optimization from your (single) endpoint to clients literally half a world away?

As I user, I simply don't care. I repeatedly get punished for doing nothing wrong. It's almost like airport security. > What does your cdn solution look like? > Route optimization from your (single) endpoint to clients literally half a world away? And as a developer, I don't understand this newfangled obsession over CDNs either. Yes, there will be 200 ms RTT in some cases. So what? Get over it. Optimize your website…

[deleted]

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#220

Post by ehutch79 »

grishka wrote: post #202
comex wrote: post #199

Earlier quoted context omitted.

There's no need to guess based on the speed of light. Test it yourself: https://www.cloudping.info For me, the highest was 310ms round trip to Singapore, so higher than your estimate but not too bad. But this is completely beside the point. As far as I know, if you're using a CDN effectively (i.e. a large proportion of requests are hitting cache), it should be cheaper than having all requests hit your server, not mor…

338 ms to Sydney is my worst. 234 ms to Singapore. AWS does offer a CDN, right? Somehow they do it without captchas and without me ever noticing. So I'm somewhat right at cursing at cloudflare because it's the only one actually announcing its presence by actively disrupting your browsing.

Cloudfront, the aws cdn, is not equivalent to the part that's showing a captcha. Only when it would have hit your server do you see the captcha, because it's proxying it, not serving cached results.
Post reply on HN