Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

121–130 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#121

Post by mootothemax »

b65e8bee43c2ed0 wrote: post #62
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.

Exactly. I’m constantly amazed at how little you actually need to bypass CF, Amazon, Azure WAFs and so on (Incapsula springs to mind too). When you look at the code you’ve come up with, it’s actually quite small and compact.

More to the point, these systems actually help scraping because proof of work unlocks essentially unlimited scraping, in my experience.

That said - from my experience on the other side, sure you can’t stop people like me or you, but you can stop 99% of the others. That’s more than worth it operationally.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#122

Post by sandeepkd »

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecologically a nightmare), probably fingerprinting is the way to go - completely destroying the privacy of everyone involved.

Bot protection with fingerprinting is just an illusion. Any signals like this which is on client side can be spoofed by an above average person. Fingerprinting is just way to consolidate the market for advertising business. Assigning Reputation to residential IP addresses and commercial blocks is is another approach to achieve the desired result. Providers would be a lot more careful to allow their IP addresses for misuses, however turns out that it would bring down the DDOS business on both sides, attackers and protectors.

Ironically, more than often its the same companies that invest in building their own bots and finding ways to stop bots from other companies.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#123

Post by t_mahmood »

notafox wrote: post #85
PearlRiver wrote: post #32

Earlier quoted context omitted.

This is why I have two separate browsers. If you want to do official stuff like paying for things you need to get through cloudflare.

You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles. Firefox with a non-default profile can be created like that: ./firefox -CreateProfile "profile-name /home/user/.mozilla/firefox/profile-dir/" # For, say, cloudflare that would be: ./firefox -CreateProfile "cloudflare /home/user/.mozilla/firefox/cloudflare/" An…

You do now do this from `Profiles` menu too, without going down to CLI path. It's extremely simple now.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#124

Post by mootothemax »

ribtoks wrote: post #38
adamtaylor_13 wrote: post #22

So if you need to prevent bot abuse, but also don't want an ugly captcha every time someone goes to sign up, is there a better option?

Use proof-of-work captchas, many are private by default. Look into Private Captcha or Cap captcha.

Speaking from the scraper’s perspective, I like proof of work; a ten year old 96-core server will cost a couple of quid to run for a few hours and will grab an absurd number of pages thanks to the access granted by repeatedly solving proofs of work. Small slick codebases too!

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#125

Post by thayne »

notafox wrote: post #86
helterskelter wrote: post #51

Earlier quoted context omitted.

Firefox added profile switching recently. Works good. (That said, I still keep separate machines. One for doing "official" things, the other for everything else)

> Firefox added profile switching recently. I think this was as recent as 25 years ago? Recently they added some new UI. There was and still is (I think) classic Profile Manager UI, which you can launch with ./firefox -ProfileManager or access UI in about:profiles. But you don't have to use any of those anyway - see my comment above (a response to parent).

The old UI was pretty difficult to use, and hard to discover unless you knew where to look though.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#126

Post by ashishbijlani15 »

Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

[dead]

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#127

Post by btown »

avallach wrote: post #28

Doesn't this mean we just need to make the webgl fingerprint resistance implementation smarter? Instead of explicitly rejecting webgl access or responding with dummy data, respond with data that is random within space of N common and reproducible patterns. E.g. emulate webgl implementation of some low spec but actually popular devices.

The last screenshot in the OP article mentions that "a browser extension... adding random noise to canvas data" can be detected. Which isn't to say this perfectly detects all such randomization, but it's certainly an active part of the arms race.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#128

Post by konform »

dblohm7 wrote: post #98

> Plus privacy.resistfingerprinting isn't enabled even when selecting "Strict" "Enhanced Privacy Protection" in the settings, great job there Mozilla. That pref is there for the Tor Browser.

It's enabled by default in Tor Browser and I'm not sure it can even be disabled?

Also enabled by default for Konform Browser and Mullvad Browser, which borrow many of the privacy- and security-related patches from Tor Browser.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#130

Post by tosti »

4oo4 wrote: post #79

I tested this extension that I've been using for a long time on the turnstile page and it got through, fwiw. I think it's a bit more subtle than how resistfingerprinting works but not sure what the privacy tradeoff is. https://github.com/kkapsner/CanvasBlocker

Looks cool. And I wonder why I'd run this over JSshelter. It appears to do the same thing, no?
Post reply on HN