Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

261–270 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#261

Post by ehutch79 »

withinboredom wrote: post #244
ehutch79 wrote: post #187

Earlier quoted context omitted.

Apologies, your username looks like the one that tossed that number out as a what they assumed was a high number. 200ms latency isn't that bad, but I'm seeing more 800-2000ms latencies with some users depending on physical location. at some point latency kills usability. Especially when trying to get through a complicated QA or inventory process.

That latency is literally impossible unless they’re up in space somewhere, beyond satellite orbit. Your latency is most likely caused by CPU on low-end devices. A CDN won’t help you with that (and probably be harmful having to manage another TCP connection).

Any latency over he speed of light is possible. In this case you’re seeing people in bad places, like rural China, or Long Island...

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#262

Post by bryan_w »

rudedogg wrote: post #164

I'm so fed up with reCAPTCHA. ~90% of the time it doesn't work on desktop Safari (I can see CORS errors in the console), so I have to use a different browser. Even Gumroad won't let me buy things due to this. It really feels like an anti-competitive "bug" (read feature), and is so annoying it's hard to not just give up and use Chrome. I feel like I'm crazy – no one else complains. I've mentioned @GumRoad on twitter b…

You may wanna check your computers for viruses. Getting captchas often is usually a sign your IP address has been up to some shady activity.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#263

Post by NaturalPhallacy »

tick_tock_tick wrote: post #222
grishka wrote: post #204

Earlier quoted context omitted.

Are ddos attacks a common enough occurrence to warrant putting half the internet behind ddos protection? In my impression you need to do something really wrong to deserve one.

Yes, they absolutely are. Hell just getting a few random bots scraping stuck in a loop or being overly aggressive on your site is enough to double your bill. So yeah it's 100% required.

Did we collectively forget rate limiting exists or something?

One bot that's just stuck on a loop or being overly aggressive is going to have one IP.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#264

Post by o-__-o »

midev wrote: post #243
o-__-o wrote: post #229

Earlier quoted context omitted.

(a) Who said I was blasting your site with requests? Cloudflare stops much more than just blasts (b) But you’re a-ok with Google doing this. Gated communities aren’t really good for anybody but I see what you are saying.

Gated communities are great. They lower the risk of crime significantly: https://www.sciencedaily.com/releases/2013/03/130320115113.h... The same is true online. Apple's walled garden has kept hundreds of millions of people safe on their device. It's why iOS malware isn't a thing. > Cloudflare stops much more than just blasts Exactly. There's even more benefit to Cloudflare than just DDoS. Captcha's for stopping cred…

..Didn’t realize my startup search engine stuffed credentials :(

But hey if I pay Cloudflare enough, then I’ll get to blast your site and possibly stuff creds at the same time :/

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#265

Post by NaturalPhallacy »

ehutch79 wrote: post #151
grishka wrote: post #148

Earlier quoted context omitted.

Yeah, so centralizing the entire internet around a black box that sees all your traffic in cleartext is clearly the right solution. /s > Dealing with a wordpress site getting hacked because you missed an update by a day Maybe don't use something this vulnerable then and rely on a third party to protect you from exploits. > or a bulletin bored getting swarmed with bots Maybe require email verification and/or a captcha…

Monocultures are always bad, but I don't see any alternative services with this level of ease of use. You're definitely overestimating the technical expertise/available time of a lot small time admins out there. You don't see bots and spam on those forums either because they are actually using cloudflare, and you're just not seeing the captcha, or because in the backend they're feeding all their posts through akismet…

>prevents a bunch of crap that site operators just don't want to deal with

>I don't see any alternative services with this level of ease of use.

Both of these boil down to laziness, IMHO. And for how awful they are for half the internet, that's not okay to me. Not as a user or as a developer.

When a user requests a site they expect to get the site. When you utterly disregard their utterly reasonable expectation and force them to train someone's ML algorithm for free for a minute or two you utterly destroy the user experience.

If that's my experience as a user, your entire site gets an instant 1/10 rating from me. I'll likely leave instantly and never return.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#266

Post by NaturalPhallacy »

fierro wrote: post #189
clukic wrote: post #138

Earlier quoted context omitted.

Clearly Cloudflare isn't responsible for the data centralization that is corrupting the internet. They are however, a very sophisticated and efficient enforcer of those policies. They've helped ensure large portions of the web is no longer crawlable, and that serves to consolidate information and power in those tech monopolies.

why is it assumed the web ought to be crawleable?

So that we can find things on it without prior knowledge.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#267

Post by NaturalPhallacy »

SXX wrote: post #29
jgrahamc wrote: post #20

Earlier quoted context omitted.

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

For instance there is no way for distributed search engines to work with CloudFlare. No, "contact me and we'll help" is not always a solution.

>No, "contact me and we'll help" is not always a solution. reply

In fact it's a textbook definition of a non-scaling solution.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#268

Post by 3np »

ve55 wrote: post #153

The way I'd put it is that Cloudflare's suggested implementation may have its issues, but the general idea of trying to verify that someone is a human and then providing this verification to services in a way that is 1) anonymous and 2) cross-compatible with other services, is the correct way to go about things (or at least has some very appealing features). I hope that we have something in the future that does this…

This general direction could be good if implemented utilizing some zero-knowledge technology (zkSNARKs and closely related families are the most commonly applied recently but ideally it'd be something that doesn't require a secure setup).

Intuitively, you would provide privacy-preserving offline attestations that e.g. one of a set of trusted parties has verified that you're a legal resident of jurisdiction X or over Y years of age, without needing to disclose any private identifiers.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#269

Post by booblik »

stingraycharles wrote: post #193
fierro wrote: post #185

Earlier quoted context omitted.

what? Have you ever dealt with a DDoS attack and the consequences on your availability and infra health?

Of course from the perspective of the website operator it’s great, but from the perspective of the user it’s frustrating. I’m not sure whether this is true, but it seems like with Firefox I get these captchas much more often than with Chrome. Sometimes they’re so difficult to solve it really takes a minute or two to do so, and it’s incredibly disturbing / an unfriendly interaction. Surely there must be a better way t…

Because you don’t actually want Cloudflare to store your browsing history on their servers. If they did it would be an insane privacy concern. So every time you get there it is like the first time.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#270

Post by rudedogg »

bryan_w wrote: post #262
rudedogg wrote: post #164

I'm so fed up with reCAPTCHA. ~90% of the time it doesn't work on desktop Safari (I can see CORS errors in the console), so I have to use a different browser. Even Gumroad won't let me buy things due to this. It really feels like an anti-competitive "bug" (read feature), and is so annoying it's hard to not just give up and use Chrome. I feel like I'm crazy – no one else complains. I've mentioned @GumRoad on twitter b…

You may wanna check your computers for viruses. Getting captchas often is usually a sign your IP address has been up to some shady activity.

Thanks, this has crossed my mind. I guess the only way to know is to check network traffic. I update all my devices within a week of every release though, and run macOS/iOS. I don't think it's the cause, but you never know.

I think reCAPTCHA just flat out breaks any form on macOS Safari. I've had a few work, so I'm guessing they changed something and it requires special configuration by the website using reCAPTCHA for macOS Safari to work (but apparently no one does it). I can't even login to Gumroad for example. I know macOS market share is small, but damn, this has to be costing businesses money.

--------------

Okay I finally researched this. It looks like it's because 'strict-dynamic' isn't supported. https://bugs.webkit.org/show_bug.cgi?id=184031.

I can't imagine how many people have switched to Firefox/Chrome because of this issue. You basically can't register for anything, since reCAPTCHA is used practically everywhere.

Post reply on HN