Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

51–60 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#51

Post by helterskelter »

PearlRiver wrote: post #32
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

This is why I have two separate browsers. If you want to do official stuff like paying for things you need to get through cloudflare.

Firefox added profile switching recently. Works good.

(That said, I still keep separate machines. One for doing "official" things, the other for everything else)

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#52

Post by JoshTriplett »

thisislife2 wrote: post #46
ImPostingOnHN wrote: post #40

Earlier quoted context omitted.

I don't think regulation will stop web scraping, not least of which because it can be done from locations outside the jurisdiction of the regulations. > we have to acknowledge the system is broken The system is broken. It probably takes, what, 10 seconds or less to use a residential or foreign proxy, 6+ months to internationally track and prosecute a single offender? So like a million times more effort going the regu…

Just as criminal laws don't end all crimes, copyright laws and anti-scraping regulation won't end all scraping. But it will greatly reduce it and limit it to rogue actors. Two examples I can cite here are the laws against email spams and laws against unsolicited marketing calls - they had a definite impact in reducing both (even in India, from where I am, where implementation of laws are often lax).

Exactly. Bot activity is a problem of volume, not all-or-nothing. Solving 95% of it would be a win.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#53

Post by dangus »

timpera wrote: post #42
ImPostingOnHN wrote: post #39

Earlier quoted context omitted.

The tool "Anubis" uses proof of work instead

Anubis often takes more than 60 seconds to complete on low-end devices (especially old smartphones). It seems like there's no good solution.

That must be really low end then. I’ve never seen it complete in a timeframe that was slower than “I can’t even read the page before it redirects”

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#54

Post by J-Kuhn »

MyMemoryfails wrote: post #35
richwater wrote: post #26

Earlier quoted context omitted.

You mean the "Accept Cookies" banner that has become a complete joke? Pass

I think he means browser permissions, for example when browsers want notify or record your mic theres a permission check something similar for webgl.

Fun Fact: When Cookies were introduced into Netscape, you got a browser permission prompt. Then browser vendors set it to allow by default.

And then legislation required those consent boxes back, so everyone built their own, instead of demanding that the default should be changed back.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#56

Post by phoronixrly »

ribtoks wrote: post #38
adamtaylor_13 wrote: post #22

So if you need to prevent bot abuse, but also don't want an ugly captcha every time someone goes to sign up, is there a better option?

Use proof-of-work captchas, many are private by default. Look into Private Captcha or Cap captcha.

How does proof of work stop bots?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#57

Post by phoronixrly »

ImPostingOnHN wrote: post #39
adamtaylor_13 wrote: post #22

So if you need to prevent bot abuse, but also don't want an ugly captcha every time someone goes to sign up, is there a better option?

The tool "Anubis" uses proof of work instead

How does Anubis stop bots?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#58

Post by ndriscoll »

thisislife2 wrote: post #36
csomar wrote: post #25

Earlier quoted context omitted.

They are not a problem unless you "believe" it is a problem. I estimate around 20-25K hits to my website from bots per day and I have all cloudflare protections disabled. Any decently optimized server should be able to easily handle that. (it's roughly 1 request every 3 seconds).

True. But it still wastes your server resources, right? And it's sad that you have to accept that as part of the "cost" of hosting a site ...

What resources are you concerned about? An n100 minipc should be capable of serving something like a blog at 20k+ requests/second (or saturating its network).

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#59

Post by gruez »

JoshTriplett wrote: post #41

"This makes your browser appear suspicious because it looks like you're trying to hide your identity." Yeah, this needs to be burned to the ground.

Bad optics aside, it doesn't actually reflect reality. See my other comment. You can enable basically all the privacy settings and still pass turnstile. Tor browser in a VM passes it, of all things.

https://litter.catbox.moe/gaizpk692bhhs6b7.png

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#60

Post by stephantul »

phoronixrly wrote: post #56
ribtoks wrote: post #38

Earlier quoted context omitted.

Use proof-of-work captchas, many are private by default. Look into Private Captcha or Cap captcha.

How does proof of work stop bots?

Because it destroys the economics of scraping. It’s too expensive with proof of work, or at least not as economically viable
Post reply on HN