"This makes your browser appear suspicious because it looks like you're trying to hide your identity."
Yeah, this needs to be burned to the ground.
Cloudflare Turnstile requiring fingerprintable WebGL
41–50 of 508 posts
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#42So if you need to prevent bot abuse, but also don't want an ugly captcha every time someone goes to sign up, is there a better option?
The tool "Anubis" uses proof of work instead
Anubis often takes more than 60 seconds to complete on low-end devices (especially old smartphones). It seems like there's no good solution.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#43This blog post is filled with false assumptions. >Turns out it's because Cloudflare wants to have a fingerprint of your device via WebGL, the only reason for doing this would be tracking. > So Cloudflare just banned all WebKitGTK browsers as I guess they put an exception for Safari. This is false. I ran firefox with: * hardware acceleration disabled (so software renderer, nothing to fingerprint) * resistfingerprintin…
Yep. Cloudflare and cloudflare's customers don't care about blocking people that use non-standard browsers (or accessible browsers, or feed readers, or whatever). Using cloudflare defaults is basically saying, "Only major corporate browsers released in the last year or two can access this site."
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#44...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!
And identifying a bot that is acting on my behalf. Claude go search this topic is basically the same as Googling something and clicking on the results. Human driven AI searching needs to be in a different box than AI scraping for training data. Which sounds extremely difficult to differentiate
Hopefully it stays that way; "a bot acting on my behalf" is still a bot. At least it's often a well-behaved bot and uses a user-agent that can be detected and blocked.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#45This blog post is filled with false assumptions. >Turns out it's because Cloudflare wants to have a fingerprint of your device via WebGL, the only reason for doing this would be tracking. > So Cloudflare just banned all WebKitGTK browsers as I guess they put an exception for Safari. This is false. I ran firefox with: * hardware acceleration disabled (so software renderer, nothing to fingerprint) * resistfingerprintin…
> My guess is that OP's browser is getting banned because his WebKitGTK has a weird fingerprint, not because of webgl or whatever.
So why is Cloudflare saying the author got blocked because of WebGL?
> > Such things are blocked in WebKit, and have been for years. Meaning it's tracking so awful that even Apple would block it, and as far as I can tell it's not the kind of privacy protection you can easily disable in it.
> This is also false. Webgl fingerprinting works just fine on Safari. They might try to mitigate it by adding some noise, but that's not so different than what firefox does, and is certainly not "blocked".
While I don't have an iDevice to try, the assumption that they are special cased is fair... because they are: https://blog.cloudflare.com/eliminating-captchas-on-iphones-...
(Yes, this is basically WEI in a shinier package.)
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#46Earlier quoted context omitted.
The only solution is regulation . If all content created by anyone has a copyright, how does an implicit opt-in (which is what happens if you don't create a robots.txt file for your website) for scraping make any sense? Moreover, even if you have a robots.txt, AI (or whatever) bots often don't respect it (or use workarounds - they outsource scraping of such "restricted" sites to unethical third-parties to get the dat…
I don't think regulation will stop web scraping, not least of which because it can be done from locations outside the jurisdiction of the regulations. > we have to acknowledge the system is broken The system is broken. It probably takes, what, 10 seconds or less to use a residential or foreign proxy, 6+ months to internationally track and prosecute a single offender? So like a million times more effort going the regu…
Just as criminal laws don't end all crimes, copyright laws and anti-scraping regulation won't end all scraping. But it will greatly reduce it and limit it to rogue actors. Two examples I can cite here are the laws against email spams and laws against unsolicited marketing calls - they had a definite impact in reducing both (even in India, from where I am, where implementation of laws are often lax).
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#47Earlier quoted context omitted.
The tool "Anubis" uses proof of work instead
Anubis often takes more than 60 seconds to complete on low-end devices (especially old smartphones). It seems like there's no good solution.
There's not an easy, perfect solution, for sure. Newer phones get faster, but spammer compute gets cheaper.
Some sort of decentralized trust web seems like another option, though less viable.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#48This blog post is filled with false assumptions. >Turns out it's because Cloudflare wants to have a fingerprint of your device via WebGL, the only reason for doing this would be tracking. > So Cloudflare just banned all WebKitGTK browsers as I guess they put an exception for Safari. This is false. I ran firefox with: * hardware acceleration disabled (so software renderer, nothing to fingerprint) * resistfingerprintin…
> My guess is that OP's browser is getting banned because his WebKitGTK has a weird fingerprint, not because of webgl or whatever. So why is Cloudflare saying the author got blocked because of WebGL? > > Such things are blocked in WebKit, and have been for years. Meaning it's tracking so awful that even Apple would block it, and as far as I can tell it's not the kind of privacy protection you can easily disable in it…
>So why is Cloudflare saying the author got blocked because of WebGL?
No idea. I can't even reproduce the error OP got with webgl disabled.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#49Please, anyone from EU (US is doomed rofl) create a petition to ban browser-fingerprinting in EU, across all existing browsers. I'm not good at creating petitions but can happily sign it. Also with stop killing games and anti-chat control. I can imagine this can get a traction, if it's explained in youtube video to "normal" people.
A better solution would be to make webgl, webgpu and (especially) webrtc have some sort of prompt before they can be in any way used in that fashion, but this will absolutely destroy web ux Windows Vista style.
And then the gatekeepers like Cloudflare will say "please hit accept in order to verify your browser and access this site".
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#50Earlier quoted context omitted.
Let's say I'm selling concert tickets. How do I prevent bots from buying up all the tickets and scalping them?
I'd simply check filling speed, even with browser's autocomplete humans are slow due needing click submit. Then when it's "processing", do them in bulk and prioritize slower users. There's huge opportunity do bot checks after checkout without affecting user experience. Also on product launches you could add unique field which requires user to input, for example that way bots can't prepare for launches.
huh. no wonder my password manager's auto submit triggers bot detection (it's a fairly popular one).