Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

321–330 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#321

Post by Dylan16807 »

epistasis wrote: post #299
dotancohen wrote: post #211

Earlier quoted context omitted.

> I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. So why not just shut down the website? Or remove the form entirely? That will ensure that you get no spam, right? One of the core tenets of system design is Availability. If your service is not available - if your forms are blocking legitimate users - then…

> So why not just shut down the website? Or remove the form entirely? That will ensure that you get no spam, right? Turns out that people have a tolerance for a non-zero amount of work, but still have a limit. Suggesting "turn off your website" is does not account for the desire to also provide some access. Treat people who host content as humans, just as we must treat users as humans. There are tradeoffs, suggesting…

> There are tradeoffs, suggesting "shut down your website unless you provide access everywhere" is worse on all fronts for everyone.

Maybe, maybe not.

If block-heavy websites shut down entirely, we lose some content, but other content moves to block-minimal sites and the average user might be able to access more.

Also if there's no blocking crutch, and people get pushed into shutdown and are mad about it, they might fight harder for anti-spam technology and legal enforcement, which could improve the situation.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#322

Post by himata4113 »

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

I mean all bot protection is useless at the end of the day, every time I have to bypass it I can do so in roughly 3 to 5 hours both 2 years and and more recently around 1 month ago. 2 years ago it was an absolute joke and only took me 30 minutes.

Well I mean maybe it wasn't useless 2 years ago, but in the age of AI it definitely is.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#323

Post by codedokode »

ethin wrote: post #164
jwr wrote: post #96

Earlier quoted context omitted.

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

> AI bots which hammer servers

You can easily calculate which IPs/networks bots are using by looking at where most traffic comes from and who requests lot of pages with non-human speed.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#324

Post by codedokode »

dr_um wrote: post #196
jwr wrote: post #165

Earlier quoted context omitted.

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…

A small, single EU country focused non-static e-commerce, with proper robots.txt instructions that worked perfectly well in the search & co bots -only "era" with rate limiting for nginx/php-fpm setup - is kinda struggling without CF to handle 15000 requests per 15 minutes, coming from Chrome "users" from IPv6. Best so far was an avg. server load in htop = 40 on an 8-core server x_x

You can calculate traffic stats for a day by IPs/subnets and probably bots will stand out. If they are using IPv6 you can figure out the ASN and block it completely.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#325

Post by choppaface »

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

besides proof-of-work, is there any realistic alternative to fingerprinting?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#326

Post by NoMoreNicksLeft »

Kiboneu wrote: post #120

In other words, Cloudflare requires you to substantially increase your browser’s attack surface in order to visit websites.

You're not quite going far enough. Cloudflare requires that you allow it to attack your browser, as a sort of virtual hazing ritual, before you're allowed into the club. That this hazing makes your browser vulnerable to attacks by others too is a side effect that bothers them not at all.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#327

Post by Terr_ »

jwr wrote: post #96
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

I think what gives me anxiety about the whole situation is:

1. If X% of the population gets wrongly branded with the scarlet letter B[ot], how do they appeal and get it fixed?

2. How will sites notice and know if their choice of "bot protection" is losing them X% of users/customers/job-seekers etc.? If it's a really robust system, they'll never even see the complaints either...

3. If everyone does detect that something is awry, will it be such a monopoly that there's no choice but to let it happen?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#328

Post by marticode »

gruez wrote: post #157
binaryturtle wrote: post #141

Earlier quoted context omitted.

I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."

>I wonder if the website owners realise at all how many actual users they lose by this sort of "protection." How many people do you think are browsing with a weird enough config (eg. custom browser like OP, or some weird config like firefox with fingerprinting protection on a raspeberry pi) to trip cloudflare's protection?

I use a plain Firefox on a plain Windows 11 PC on a plain regular mass market ISP in a developed country and I get completely blocked by websites daily.

At least let me complete a "prove you are human" challenge or something, but don't outright ban my IP address?

Post reply on HN