Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

361–370 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#361

Post by Unit327 »

ethin wrote: post #164
jwr wrote: post #96

Earlier quoted context omitted.

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

Anubis is one alternative, kinda sucks that we need to slow down the web for everyone a little bit though.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#363

Post by UqWBcuFx6NV4r »

raxxorraxor wrote: post #360
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

I would like my browser to not pass their challenge and then flush support of services I cannot reach. This is the only way for them to stop, to really get on the nerves of their customers. Those might ignore it, but there are always alternatives.

That is delusional. Nobody is getting on anyone’s nerves, materially. The people who care about this are a rounding error of a rounding error.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#364

Post by UqWBcuFx6NV4r »

leonidasrup wrote: post #171
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

Fingerprinting for "bot protection" is indistinguishable from fingerprinting for mass surveillance.

[flagged]

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#365

Post by redox99 »

CodeBytes wrote: post #316
redox99 wrote: post #258

Earlier quoted context omitted.

What I do is have more strict rate limits for non logged in users. You tell them to log in if they hit the rate limit. For non logged in users, you have a rate limit not just for IP, but also for /24 and /16. Forget about IPv6, IPv4 scarcity is a feature not a bug.

The bot I had was using unique IPs for each request. Some were from cloud providers but most were just random residential ISPs. I couldn't see any obvious connections so rate limiting would've had to be a global rate limit. Similar to the one SQLite had: https://www2.sqlite.org/forum/forumpost/7d3eb059f81ff694?t=h Each IP only makes ~1 request though so easy to detect after the fact. I guess they will run out of IPs…

You were getting 1k rps, and each request was from an unique IP? So after an hour you got hit by 3.6M different IPs? And all from uncorrelated /16s? That seems hard to believe. Not that I don't believe you, it's just hard for me to grasp that whoever was scraping you had such a large and distributed swarm.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#366

Post by arbol »

Wowfunhappy wrote: post #253
arbol wrote: post #192

Earlier quoted context omitted.

- behavioural fingerprinting - ja4 - IP rep - queue mechanism - card country to IP country checks - app attestation - custom metrics based on knowledge of past scalpers It's hard but it's not impossible. You can make it very inconvenient for scalpers. They need to poll at volume so their behaviour is very much detectable. A hard stance is required on IP rep, especially for more in demand concerts.

I don't now, a lot of this seems just as invasive as WebGL fingerprinting, if not more invasive.

It's either that or you tie tickets to government ID like in France. If the arbitrage opportunity is more than the cost of automation then someone will exploit it.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#367

Post by jeroenhd »

drnick1 wrote: post #341
jeroenhd wrote: post #113

> Plus privacy.resistfingerprinting isn't enabled even when selecting "Strict" "Enhanced Privacy Protection" in the settings, great job there Mozilla. For good reason. I've run that setting for ages but I kept having to disable it and add workarounds because websites would break in weird ways. Timezones in scheduling websites being messed up nearly made me miss a couple of appointments. There's no way to tell the use…

> Timezones in scheduling websites being messed up nearly made me miss a couple of appointments. The reason for spoofing the time zone (to UTC) is that it is one of the many things used to fingerprint users. There is an unintended side effect however: a mismatch with the IP geolocation could out you as a VPN user even if no VPN is actually used.

Of course, but the impact on many web stuff was one of the reasons I didn't turn the option on as part of my standard Firefox setup anymore.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#368

Post by jeroenhd »

croes wrote: post #117
jeroenhd wrote: post #113

> Plus privacy.resistfingerprinting isn't enabled even when selecting "Strict" "Enhanced Privacy Protection" in the settings, great job there Mozilla. For good reason. I've run that setting for ages but I kept having to disable it and add workarounds because websites would break in weird ways. Timezones in scheduling websites being messed up nearly made me miss a couple of appointments. There's no way to tell the use…

Maybe a good reason for not enabling it by default but a bad reason to not enabling it for strict settings. I somewhat expect breaking sites with strict settings, I don’t expect an still wide open tracking path. That’s deceiving.

Even with resistFingerprinting, websites will be able to fingerprint you. There is no full immunity against fingerprinting.

Websites already break often with the strictest protections enabled, adding a "super duper strict protections" mode will just lead to bug reports. Even more-than-bare-basic tracking prevention has HN threads full of comments like "doesn't work on " because they don't see the connection between fingerprinting protection, WebRTC/WebGL/WebGPU, and websites not working.

People who are willing to take that bet can enable it in about:config.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#369

Post by hem777 »

ethin wrote: post #164
jwr wrote: post #96

Earlier quoted context omitted.

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

The alternative is not have that one choke point that can be hammered. Decentralize.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#370

Post by dchest »

raxxorraxor wrote: post #360
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

I would like my browser to not pass their challenge and then flush support of services I cannot reach. This is the only way for them to stop, to really get on the nerves of their customers. Those might ignore it, but there are always alternatives.

They'll just tell you to clear cookies and use Chrome.
Post reply on HN