Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

21–30 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#21

Post by tardedmeme »

fidotron wrote: post #14
Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

> ...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? There isn't one, and pretending otherwise is nonsense because humans will always provide their credentials to something to act on their behalf. In the limit you end up with Chinese phone farms.

Right. Botnet operators love cloudflare because they make so much money renting out compromised machines to pass their tests.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#24

Post by doctorpangloss »

Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

web environment integrity

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#25

Post by csomar »

Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

They are not a problem unless you "believe" it is a problem. I estimate around 20-25K hits to my website from bots per day and I have all cloudflare protections disabled. Any decently optimized server should be able to easily handle that. (it's roughly 1 request every 3 seconds).

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#26

Post by richwater »

fidotron wrote: post #16
Fokamul wrote: post #5

Please, anyone from EU (US is doomed rofl) create a petition to ban browser-fingerprinting in EU, across all existing browsers. I'm not good at creating petitions but can happily sign it. Also with stop killing games and anti-chat control. I can imagine this can get a traction, if it's explained in youtube video to "normal" people.

A better solution would be to make webgl, webgpu and (especially) webrtc have some sort of prompt before they can be in any way used in that fashion, but this will absolutely destroy web ux Windows Vista style.

You mean the "Accept Cookies" banner that has become a complete joke? Pass

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#27

Post by MyMemoryfails »

Wowfunhappy wrote: post #17
malka1986 wrote: post #15

Earlier quoted context omitted.

> keeping out bot You can forget about it. It is not possible. Simple as that.

Let's say I'm selling concert tickets. How do I prevent bots from buying up all the tickets and scalping them?

I'd simply check filling speed, even with browser's autocomplete humans are slow due needing click submit.

Then when it's "processing", do them in bulk and prioritize slower users. There's huge opportunity do bot checks after checkout without affecting user experience.

Also on product launches you could add unique field which requires user to input, for example that way bots can't prepare for launches.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#28

Post by avallach »

Doesn't this mean we just need to make the webgl fingerprint resistance implementation smarter? Instead of explicitly rejecting webgl access or responding with dummy data, respond with data that is random within space of N common and reproducible patterns. E.g. emulate webgl implementation of some low spec but actually popular devices.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#29

Post by spacedoutman »

Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

Private invite only internets

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#30

Post by gruez »

This blog post is filled with false assumptions.

>Turns out it's because Cloudflare wants to have a fingerprint of your device via WebGL, the only reason for doing this would be tracking.

> So Cloudflare just banned all WebKitGTK browsers as I guess they put an exception for Safari.

This is false. I ran firefox with:

* hardware acceleration disabled (so software renderer, nothing to fingerprint)

* resistfingerprinting enabled, including letterboxing with default window size

* webgl disabled

* VPN enabled

* In a Windows VM

By all accounts this should be the most suspicious fingerprint ever, but turnstile happily lets me through. If they want to track people, they're doing a pretty bad job. My guess is that OP's browser is getting banned because his WebKitGTK has a weird fingerprint, not because of webgl or whatever.

> Such things are blocked in WebKit, and have been for years. Meaning it's tracking so awful that even Apple would block it, and as far as I can tell it's not the kind of privacy protection you can easily disable in it.

This is also false. Webgl fingerprinting works just fine on Safari. They might try to mitigate it by adding some noise, but that's not so different than what firefox does, and is certainly not "blocked".

Post reply on HN