Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

291–294 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#291

Post by fierro »

NaturalPhallacy wrote: post #263
tick_tock_tick wrote: post #222

Earlier quoted context omitted.

Yes, they absolutely are. Hell just getting a few random bots scraping stuck in a loop or being overly aggressive on your site is enough to double your bill. So yeah it's 100% required.

Did we collectively forget rate limiting exists or something? One bot that's just stuck on a loop or being overly aggressive is going to have one IP.

any sophisticated bots are rotating IPs or pulling from a large pool of IPs. In many cases of fraud/abuse, rate limiting based on IP doesn't work well enough.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#292

Post by Dylan16807 »

midev wrote: post #236
grishka wrote: post #132

Cloudflare captchas in particular, and any checks and roadblocks to see something publicly available in general, are terrible, period. It doesn't matter which form they take. Every time you see one you feel like a second-class citizen and get reminded that the internet is no longer what it used to be. I personally simply close the tab when I see a cloudflare "one more step" page.

This is completely wrong. Site administrators can put any controls they want in place to limit access. I don't know where you get the idea that things on the Internet need to be publicly available or without restriction. Unless you're an original ARPANET contributor, there have always been attempts to control access and stop attacks. You're making the same mistake every conservative does. Longing for a nostalgia that…

> I don't know where you get the idea that things on the Internet need to be publicly available or without restriction.

That's not what they said at all. They complained about breaking the access to things that were already chosen to be public.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#293

Post by sroussey »

jlokier wrote: post #201
sroussey wrote: post #176

Earlier quoted context omitted.

From experience, traffic via Tor was always 99%+ fraud.

You can conduct fraud by accessing public, read-only web pages? You can conduct fraud by searching on Google? Those are the two I find repeatedly blocked when accessing via Tor. The former by Cloudflare, the latter by Google. I use Tor to lookup phone numbers that have just called me, to decide whether it's a good idea to answer. Since I don't want to be personally associated with such numbers I prefer to search anon…

For the companies I worked for, we usually allowed Tor as read only. But net ops might override that, particularly when things moved to https traffic.
Post reply on HN