Adding noise to a canvas element is a mistake anyway. It means you can't develop a proper paint program using web technologies because your browser will mess with the image.
Cloudflare Turnstile requiring fingerprintable WebGL
91–100 of 508 posts
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#92Earlier quoted context omitted.
Any idea what the difference is between your setup and the one in the article that failed with fingerprint-resistance enabled?
He's using a custom browser, apparently: https://hacktivis.me/projects/badwolf
I'm talking about the screenshot from Firefox.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#93Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…
> but unless you do PoW (which is also ecologically a nightmare)
Can you expand? I don't see a problem with some napkin math. 5W load for 2 seconds is 0.002Wh (we have to let smartphones pass and not by doing PoW for 10s of seconds). 8 billion checks a day for a year = 8GWh.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#94Earlier quoted context omitted.
Depends on what type of scraping you're trying to stop. For the dumb scrapers that would try to scrape every page on a git forge (for which there are a bazillion pages for a modest project, because of how the site works), yeah it might deter them enough to stop. For anything high value (eg. reddit comments or retail prices), 10s of cpu time isn't going to stop them.
It will not scare away bots but 10 seconds of wait (CPU or only a sleep) will turn away many real users. "This site is so slow, I'll use something else." A kind of reverse captcha.
Maybe, the proof of work can run in the background.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#95[deleted]
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#96Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…
> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection"
They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#97Re: Cloudflare Turnstile requiring fingerprintable WebGL
#98> Plus privacy.resistfingerprinting isn't enabled even when selecting "Strict" "Enhanced Privacy Protection" in the settings, great job there Mozilla.
That pref is there for the Tor Browser.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#99Earlier quoted context omitted.
This is why I have two separate browsers. If you want to do official stuff like paying for things you need to get through cloudflare.
You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles. Firefox with a non-default profile can be created like that: ./firefox -CreateProfile "profile-name /home/user/.mozilla/firefox/profile-dir/" # For, say, cloudflare that would be: ./firefox -CreateProfile "cloudflare /home/user/.mozilla/firefox/cloudflare/" An…
Except that fingerprinting means that both profiles are actually tied together by cloudflare (and other tech companies)
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#100Adding noise to a canvas element is a mistake anyway. It means you can't develop a proper paint program using web technologies because your browser will mess with the image.
You can still do that, but it may not be rendered correctly in a screenshot.