Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

101–110 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#101

Post by denysvitali »

petu wrote: post #93
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

> but unless you do PoW (which is also ecologically a nightmare) Can you expand? I don't see a problem with some napkin math. 5W load for 2 seconds is 0.002Wh (we have to let smartphones pass and not by doing PoW for 10s of seconds). 8 billion checks a day for a year = 8GWh.

I stand corrected. It's not a nightmare scenario (as for Bitcoins) - but I'm still of the idea that "useless" computations should be avoided (as we should avoid having 10MB websites).

In any case, according to some napkin math done by Kimi 2.6 (which by itself is probably already consuming more than all of my PoW challenges for the upcoming 5 years) - the situation looks incredibly in favor of PoW: https://www.kimi.com/share/19e7ef40-a432-8912-8000-0000b4a71...

Which makes me wonder why CloudFlare isn't switching to this already

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#102

Post by [deleted] »

ndriscoll wrote: post #58
thisislife2 wrote: post #36

Earlier quoted context omitted.

True. But it still wastes your server resources, right? And it's sad that you have to accept that as part of the "cost" of hosting a site ...

What resources are you concerned about? An n100 minipc should be capable of serving something like a blog at 20k+ requests/second (or saturating its network).

[deleted]

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#103

Post by denysvitali »

jwr wrote: post #96
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

They sometimes have to comply with legal requests (which I understand), but at the same time they have a huge market share - which means that the internet is becoming less and less decentralized and more in their control. We've seen the effects of that in previous outages...

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#104

Post by opem »

notafox wrote: post #86
helterskelter wrote: post #51

Earlier quoted context omitted.

Firefox added profile switching recently. Works good. (That said, I still keep separate machines. One for doing "official" things, the other for everything else)

> Firefox added profile switching recently. I think this was as recent as 25 years ago? Recently they added some new UI. There was and still is (I think) classic Profile Manager UI, which you can launch with ./firefox -ProfileManager or access UI in about:profiles. But you don't have to use any of those anyway - see my comment above (a response to parent).

They actually have at least 3 kinds of profile: 1. containers - As they say its somekind of sandbox, technically a profile 2. profiles that are accesible through about:proflies, which they had for years, and probably the one you are talking about... 3. New profiles that comes with a pop-up much like how chromium browsers shows it

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#105

Post by stephantul »

gruez wrote: post #69
stephantul wrote: post #60

Earlier quoted context omitted.

Because it destroys the economics of scraping. It’s too expensive with proof of work, or at least not as economically viable

Depends on what type of scraping you're trying to stop. For the dumb scrapers that would try to scrape every page on a git forge (for which there are a bazillion pages for a modest project, because of how the site works), yeah it might deter them enough to stop. For anything high value (eg. reddit comments or retail prices), 10s of cpu time isn't going to stop them.

Sure, the whole premise is exactly that proof of work reduces the value of scraping, while having negligible impact on users. If the data is so valuable that bot operators are willing to pay 10s of cpu, then other measures are necessary.

Nevertheless even for these high value cases, you can still argue that it disincentivizes the business model, it becomes less efficient.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#106

Post by dcrazy »

denysvitali wrote: post #101
petu wrote: post #93

Earlier quoted context omitted.

> but unless you do PoW (which is also ecologically a nightmare) Can you expand? I don't see a problem with some napkin math. 5W load for 2 seconds is 0.002Wh (we have to let smartphones pass and not by doing PoW for 10s of seconds). 8 billion checks a day for a year = 8GWh.

I stand corrected. It's not a nightmare scenario (as for Bitcoins) - but I'm still of the idea that "useless" computations should be avoided (as we should avoid having 10MB websites). In any case, according to some napkin math done by Kimi 2.6 (which by itself is probably already consuming more than all of my PoW challenges for the upcoming 5 years) - the situation looks incredibly in favor of PoW: https://www.kimi.c…

Because it doesn’t solve the problem of residential botnets.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#107

Post by jeroenhd »

gruez wrote: post #19
malka1986 wrote: post #8

Thanks, i did not know about `privacy.resistfingerprinting` I'll make sure to fail all cloudflare turnshit in the future.

I have it enabled and turnstile works fine.

It breaks Turnstile for me on Android. Had to restart the browser for it to take effect of course.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#108

Post by jeroenhd »

gruez wrote: post #30

This blog post is filled with false assumptions. >Turns out it's because Cloudflare wants to have a fingerprint of your device via WebGL, the only reason for doing this would be tracking. > So Cloudflare just banned all WebKitGTK browsers as I guess they put an exception for Safari. This is false. I ran firefox with: * hardware acceleration disabled (so software renderer, nothing to fingerprint) * resistfingerprintin…

Enabling resistfingerprinting on my Android phone shows me the same error screen. It's not just webkit.

fingerprintingProtection works fine on the other hand, but then again that's intentionally less intrusive.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#109

Post by dcrazy »

ndriscoll wrote: post #68
Wowfunhappy wrote: post #17

Earlier quoted context omitted.

Let's say I'm selling concert tickets. How do I prevent bots from buying up all the tickets and scalping them?

Sell them via a Dutch auction. Eliminate the arbitrage opportunity for scalpers and make more money in the process.

That’s how you wind up with only kids of millionaires at your Taylor Swift concert.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#110

Post by jeroenhd »

Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

Remote attestation should still be possible with a rooted phone if phone manufacturers weren't so shit. If the attestation happens at hardware level, it doesn't matter what programs or kernels you're running.
Post reply on HN