Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

221–230 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#221

Post by yazaddaruvala »

PaulHoule wrote: post #45
SXX wrote: post #29

Earlier quoted context omitted.

For instance there is no way for distributed search engines to work with CloudFlare. No, "contact me and we'll help" is not always a solution.

I've never been able to "reach a human" at Google, Facebook and other web giants and I'm skeptical that you can at a place like Cloudflare. In fact, I'd be really astonished it was possible, because otherwise their business isn't scalable.

The grandparent, jgrahamc, you're responding to is the CTO of Cloudflare.

If this doesn't at-least meet your definition of "reach a human at Cloudflare", I'm not sure what will.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#222

Post by tick_tock_tick »

grishka wrote: post #204
fierro wrote: post #185

Earlier quoted context omitted.

what? Have you ever dealt with a DDoS attack and the consequences on your availability and infra health?

Are ddos attacks a common enough occurrence to warrant putting half the internet behind ddos protection? In my impression you need to do something really wrong to deserve one.

Yes, they absolutely are. Hell just getting a few random bots scraping stuck in a loop or being overly aggressive on your site is enough to double your bill. So yeah it's 100% required.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#223

Post by ehutch79 »

Dylan16807 wrote: post #194
ehutch79 wrote: post #179

Earlier quoted context omitted.

No it doesn't. at all. Page load speeds by themselves can be painful. Open devtools and have your browser throttle to poor 3g speeds. Try browsing around. even well optimized sites. Now try uploading a couple dozen files through an api. This is legit what some users deal with. In New York state even, you don't need to go that far to find poor connectivity. Even if all your users have awesome home connections, think s…

If you're on 3G I would expect sites to load in a similarly bad way with or without an extra most of 200ms of RTT.

The throttling in dev tools is meant to represent that latency...

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#224

Post by ehutch79 »

jlokier wrote: post #201
sroussey wrote: post #176

Earlier quoted context omitted.

From experience, traffic via Tor was always 99%+ fraud.

You can conduct fraud by accessing public, read-only web pages? You can conduct fraud by searching on Google? Those are the two I find repeatedly blocked when accessing via Tor. The former by Cloudflare, the latter by Google. I use Tor to lookup phone numbers that have just called me, to decide whether it's a good idea to answer. Since I don't want to be personally associated with such numbers I prefer to search anon…

Then don't use sites that are behind cloudflare?

It's not your choice if the site owners/admins use cloudflare. It IS your choice not to use those sites.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#225

Post by AtNightWeCode »

poisonborz wrote: post #215
AtNightWeCode wrote: post #172

There are a lot services in Sweden that requires that you provide a real authentication by using something called BankId. Basically a personal digital id. This is the way to go. 100% secure validated users. If there was a function added to make the users anonymous to third party services it would be great. I work with Cloudflare sites and it is clear that thier current enterprise offerings are hard to tweak to solve…

Ah yeah, instantly zeroing anonimity for most users, while it can be still abused by malicious actors, a great worst of both worlds solution.

Not sure how you came to that conclusion from what I said. What I am saying is that in the long run it will be impossible to rely on companies like Cloudflare for security when it comes to users. Over time all services will for security reasons need to either directly or indirectly authenticate all their users. That does not mean that each users identity is provided to each consumer.

The open Internet is already dead thanks to Cloudflare, Akamai etc. A lot of European companies use theses services to block China, Russia, TOR, VPN-services and so on.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#226

Post by [deleted] »

jjav wrote: post #214
ehutch79 wrote: post #151

Earlier quoted context omitted.

Monocultures are always bad, but I don't see any alternative services with this level of ease of use. You're definitely overestimating the technical expertise/available time of a lot small time admins out there. You don't see bots and spam on those forums either because they are actually using cloudflare, and you're just not seeing the captcha, or because in the backend they're feeding all their posts through akismet…

> My point in all this is that bitching that site is using cloudflare to not have to deal with crap, is a self centered view. Who is serving whom here? If a business thinks it's ok to impose cloudflare inconvenience on me, the customer, for the priviledge of giving them my money, who is self centered here? The simple answer is I'll close the tab and go buy it from a competitor. I'm not playing captcha games to buy so…

[deleted]

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#227

Post by kevincox »

bo1024 wrote: post #195
anothergram wrote: post #160

Earlier quoted context omitted.

Alternatively, if services demand a fee then there is no need for human verification. Instead of trying to solve anonymous human verification we can as well make micro-payment an option.

I really hate it when I'm trying to spend money at a company and get hit with a captcha box right as I click "checkout". I could see it for selling scarce items like concert tickets, but in general it's very insulting, annoying, and off-putting to me.

Credit card fraud that results in chargebacks is a very significant cost to a lot of online stores. So while it does suck it isn't the shop that is to blame.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#228

Post by tibiapejagala »

sroussey wrote: post #176
D-Nice wrote: post #171

Earlier quoted context omitted.

Why is every and any TOR and sometimes VPN user deemed a DoS attack... it discriminates against users who value privacy by forcing hCaptcha on them by default. Worst of all... it could be a de-anonymization attack as well, hence why I as a regular TOR user, just exit the page immediately when that happens. For any of my pages that do happen to use Cloudflare, I am luckily able to disable this discrimination in the CP…

From experience, traffic via Tor was always 99%+ fraud.

Well, if you keep throwing impossible captchas at them, no wonder that normal users just close the tab, but bots and fraudsters keep trying.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#229

Post by o-__-o »

midev wrote: post #119
o-__-o wrote: post #41

Earlier quoted context omitted.

So for my startup to crawl sites I must now adhere to Cloudflare’s Requirements of the Web(TM) or reach out to individual engineer, who may leave at any moment. Gotcha (but Google is allowed because Google was first to market)

Why would you possibly think you can do whatever you want to someone else's site? Yes, you must adhere to the controls that site administrators put in place, like Cloudflare.... You don't get to blast my site with requests, just because you want to...

(a) Who said I was blasting your site with requests? Cloudflare stops much more than just blasts

(b) But you’re a-ok with Google doing this. Gated communities aren’t really good for anybody but I see what you are saying.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#230

Post by o-__-o »

LinuxBender wrote: post #105
timlardner wrote: post #84

Earlier quoted context omitted.

That doesn't sound unreasonable. Out of interest, what would you consider a ridiculous speed to be crawling at?

I can't speak for Cloudflare, but crawling speed should be dictated by the site owner via the robots.txt crawl-delay. [1] A site owner could also rate-limit unauthenticated requests by IP via the cloudflare header using a 429 too many requests error page. [1] - https://en.wikipedia.org/wiki/Robots_exclusion_standard#Craw...

This here is the problem. It’s a new time no one wants to be Rfc compliant, just go behind a service and problem is solved.

So no problem, time to move on web search is no longer exciting

Post reply on HN