Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

71–80 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#71

Post by WesolyKubeczek »

ImPostingOnHN wrote: post #47
timpera wrote: post #42

Earlier quoted context omitted.

Anubis often takes more than 60 seconds to complete on low-end devices (especially old smartphones). It seems like there's no good solution.

There's not an easy, perfect solution, for sure. Newer phones get faster, but spammer compute gets cheaper. Some sort of decentralized trust web seems like another option, though less viable.

One of unexpected outcomes from AI-induced hardware shortage may be that, in fact, compute won’t be getting cheaper and may in fact get more expensive…

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#72

Post by bflesch »

avallach wrote: post #28

Doesn't this mean we just need to make the webgl fingerprint resistance implementation smarter? Instead of explicitly rejecting webgl access or responding with dummy data, respond with data that is random within space of N common and reproducible patterns. E.g. emulate webgl implementation of some low spec but actually popular devices.

All of those advanced features should be enabled on a per-website basis but unfortunately even browsers whose marketing focuses on privacy don't allow you to do that. Same with TLS root CA certificates, there is no way to configure that a certain CA can only create certificates for certain domains.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#75

Post by ajb »

helterskelter wrote: post #51
PearlRiver wrote: post #32

Earlier quoted context omitted.

This is why I have two separate browsers. If you want to do official stuff like paying for things you need to get through cloudflare.

Firefox added profile switching recently. Works good. (That said, I still keep separate machines. One for doing "official" things, the other for everything else)

Odd - they've had that for years, but only on the command line. Wonder if it's different under the hood? They also have firefox containers which also never quite became a first-class feature (you have to install a plugin).

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#76

Post by bflesch »

richwater wrote: post #26
fidotron wrote: post #16

Earlier quoted context omitted.

A better solution would be to make webgl, webgpu and (especially) webrtc have some sort of prompt before they can be in any way used in that fashion, but this will absolutely destroy web ux Windows Vista style.

You mean the "Accept Cookies" banner that has become a complete joke? Pass

It's about explicitly deciding to allow certain capabilities on a per-website basis. No major browser allows defense-in-depth via fine-grained website permissions.

Even simply changing the user agent was sabotaged at Firefox, and choosing one user agent per domain is wishful thinking.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#77

Post by bflesch »

kykat wrote: post #37
tardedmeme wrote: post #23

Earlier quoted context omitted.

Probably everyone on HN singing their praises for the past 10 years.

And my og comment getting downvoted on this very intellectual forum that definitely isn't an echo chamber

Cognitive dissonance in tech millionaires is quite strong, still worth it to trigger them from time to time on a factual basis.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#78

Post by pmontra »

gruez wrote: post #69
stephantul wrote: post #60

Earlier quoted context omitted.

Because it destroys the economics of scraping. It’s too expensive with proof of work, or at least not as economically viable

Depends on what type of scraping you're trying to stop. For the dumb scrapers that would try to scrape every page on a git forge (for which there are a bazillion pages for a modest project, because of how the site works), yeah it might deter them enough to stop. For anything high value (eg. reddit comments or retail prices), 10s of cpu time isn't going to stop them.

It will not scare away bots but 10 seconds of wait (CPU or only a sleep) will turn away many real users. "This site is so slow, I'll use something else." A kind of reverse captcha.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#80

Post by JoshTriplett »

gruez wrote: post #59
JoshTriplett wrote: post #41

"This makes your browser appear suspicious because it looks like you're trying to hide your identity." Yeah, this needs to be burned to the ground.

Bad optics aside, it doesn't actually reflect reality. See my other comment. You can enable basically all the privacy settings and still pass turnstile. Tor browser in a VM passes it, of all things. https://litter.catbox.moe/gaizpk692bhhs6b7.png

Any idea what the difference is between your setup and the one in the article that failed with fingerprint-resistance enabled?
Post reply on HN