No mention of hcaptcha. Is this still worth it if you are hcaptcha user?
Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
21–30 of 82 posts
Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
#22What is the failure case for the Cloudflare captcha? In case browser fingerprinting fails to identify me as a human, do they fallback to a challenge that humans can solve, such as audio or image challenges?
Say what you will about Recaptcha, but they do have a way to eventually pass through the challenge.
Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
#23This is yet another example of Cloudflare centralizing the web. I’m tired of this. Sure the only previously viable solution was ReCAPTCHA from Google. But it’s Google. I depend on them for search. And, sure, their business model depends on them being able to track me online. But I know them. And it’s hard for me to live without them. So I’m ok with depending on them, but I worry about further centralization of the In…
I'm of two minds on this topic of centralization.
On the one hand, I did post a reactionary hot take yesterday in response to the "pardon me, Cisco" ad that you posted [1]. I'm sorry for that; I should have kept that immediate reaction to myself. Still, I'm apprehensive about increasing the power of one of a handful of big players by routing my company's web traffic through Cloudflare, let alone running applications themselves on the Cloudflare platform, though Workers is certainly interesting technology. And I'm certainly not going to route all of my Internet traffic through Warp, or even use 1.1.1.1 for DNS.
But in the specific case of Turnstile, it is clearly now the least bad option. So I will be happy to use it when something like a CAPTCHA is needed.
Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
#24Earlier quoted context omitted.
That would just DRMize the web with a few select browsers being allowed to access content and the rest being left to dust.
Not really - how could it be worse than the status quo? Worse case you could use turnstile, no?
Companies will realize the majority of abuse comes from humans completing CAPTCHAs and little to none from TPM attestations. It's then a small leap to only trust TPMs and lock everyone else out. After all, every genuine user has an OS that requires a TPM.
Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
#25Earlier quoted context omitted.
That would just DRMize the web with a few select browsers being allowed to access content and the rest being left to dust.
Not really - how could it be worse than the status quo? Worse case you could use turnstile, no?
Cloudflare’s scheme with PATs is essentially a form of attestation, which, realistically, will only be implemented by Microsoft, Apple and Google, and if you’re a Linux or BSD user which isn’t integrated with a device manufacturer, you’d just have no other choice.
This is an unpopular opinion, but Recaptcha has never had this problem. I might face a few more captcha image screens to solve, but what’s being proposed with PATs is dangerous.
Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
#26This looks great, Cloudflare will always be Better Privacy wise than Google.
> without having to be a Cloudflare customer or sending traffic through the Cloudflare global network
And you don't even need to use CF as a proxy.
Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
#27What is the failure case for the Cloudflare captcha? In case browser fingerprinting fails to identify me as a human, do they fallback to a challenge that humans can solve, such as audio or image challenges? Say what you will about Recaptcha, but they do have a way to eventually pass through the challenge.
Depending on the mode you choose there can be an interactive element
Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
#28This is yet another example of Cloudflare centralizing the web. I’m tired of this. Sure the only previously viable solution was ReCAPTCHA from Google. But it’s Google. I depend on them for search. And, sure, their business model depends on them being able to track me online. But I know them. And it’s hard for me to live without them. So I’m ok with depending on them, but I worry about further centralization of the In…
If Google or Facebook offered Cloudflare $100B they’d probably have to take it. Add a quick TOS change and we are s-o-l. Hello gigantic super revenue earning centralized ad network (!$!$!).
In all seriousness, I don’t see Cloudflare centralizing the web. I see them decentralizing it by empowering smaller folks with easier tools for scale.
It’s a stretch of argument / not perfect —- but I am glad the competition exists. It makes sense for Cloudflare to be big and privacy focused when competing in the big net real estate space of the modern web.
Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
#29As much as I _despise_ modern ReCAPTCHA, I have always been able to pass the challenge eventually; it has never flatly rejected me with no recourse. If I made a mistake or was insufficiently human for it, I got a new challenge and tried again. There are apocryphal stories of Google tar-pitting users with it, but I have never seen it in action. If this judges the browser more than the user, what do I do when the brows…
> There are apocryphal stories of Google tar-pitting users with it, but I have never seen it in action.
That used to be the case when using Tor; I remember having to rotate exit nodes to get recaptcha to load at all.
These days the situation is a lot better, I've been able to pass Google captchas through Tor every time I tried this month. Seems like they even fixed audio-based captchas, so you no longer get instant-blocked if you try to use them.
Of course, all this could be reverted tomorrow, and there would be absolutely nothing we could do about it...
Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
#30As much as I _despise_ modern ReCAPTCHA, I have always been able to pass the challenge eventually; it has never flatly rejected me with no recourse. If I made a mistake or was insufficiently human for it, I got a new challenge and tried again. There are apocryphal stories of Google tar-pitting users with it, but I have never seen it in action. If this judges the browser more than the user, what do I do when the brows…
I've had to go a few rounds with the photo match.
Where I usually get tarpitted is by Cloudflare. I'll pass the (automated) CAPTCHA, the page will reload (still as if I had passed), and … it'll be another CAPTCHA. I'm pretty sure these usually amount to a passive-aggressive demand for cookies/storage, but I just vote with my browser & go back/somewhere else.