Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

401–410 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#401

Post by miki123211 »

drnick1 wrote: post #341
jeroenhd wrote: post #113

> Plus privacy.resistfingerprinting isn't enabled even when selecting "Strict" "Enhanced Privacy Protection" in the settings, great job there Mozilla. For good reason. I've run that setting for ages but I kept having to disable it and add workarounds because websites would break in weird ways. Timezones in scheduling websites being messed up nearly made me miss a couple of appointments. There's no way to tell the use…

> Timezones in scheduling websites being messed up nearly made me miss a couple of appointments. The reason for spoofing the time zone (to UTC) is that it is one of the many things used to fingerprint users. There is an unintended side effect however: a mismatch with the IP geolocation could out you as a VPN user even if no VPN is actually used.

It's quite incredible how much you can learn about a person just by knowing their user agent, country of origin and list of preferred languages.

When Youtube still supported trends, visiting the trends page from Poland with Safari set to English gave you really interesting results. Mostly intellectually-stimulating content from channels like Veritasium, with a smattering of reviews, trailers, music and focus soundtracks thrown in. Meanwhile, visiting that same page on (Windows) Chrome set to Polish gave you the typical "you won't believe what this man just did!!!" crap.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#402

Post by miki123211 »

0x59 wrote: post #195
userbinator wrote: post #175

"If they know you're spoofing, you're not spoofing hard enough." This stupid "war against bots" is going to lead to the downfall of the Internet and effectively turn it into another walled garden where only "approved" (anti-)user agents are allowed. Don't fall for the nonsense about "AI scrapers" --- it's just a way to manufacture consent.

Idk, if bots ate hammering your server then setup rate limits. If you have content that you don't want others to have access to, don't serve it with a webserver.

There is something to be said for "one way indexes."

Imagine you run a company register for a local government. You want to let people look up companies by their registration number (which they must disclose in all communications to you) to see if they're legit and whether any warnings have been raised against them. You don't want unscrupulous marketers to just be able to `SELECT * FROM companies WHERE type='nail_salon' AND city='london'`.

If you aren't super strict about scraping, some shadowy business in Neverland, completely unconcerned with following your laws, will build that database.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#405

Post by account42 »

DR_MING wrote: post #362

It feels like we're moving toward a web where proving you're a human becomes a larger part of the browsing experience.

You mean proving that you are using an approved browser. The "proving you're a human" part is already owellian doublespeak.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#406

Post by account42 »

fulafel wrote: post #307

WebGL fingerprinting is of course an attack and a unintended use of the WebGL API. Browser vendors should respond to this misuse somehow (reputation based blacklist?).

WebGL should just require a permission prompt, JS too really. No reason that every page you visits should be free to run stuff on your CPU and GPU.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#407

Post by account42 »

Wowfunhappy wrote: post #286
thisislife2 wrote: post #46

Earlier quoted context omitted.

Just as criminal laws don't end all crimes, copyright laws and anti-scraping regulation won't end all scraping. But it will greatly reduce it and limit it to rogue actors. Two examples I can cite here are the laws against email spams and laws against unsolicited marketing calls - they had a definite impact in reducing both (even in India, from where I am, where implementation of laws are often lax).

I basically agree that the idea should be to reduce, not eliminate, bots. However, a big difference with crimes involving the internet is that they can be launched from anywhere. In the real world, I can't steal from someone unless I'm physically present in the same country as my victim. On the internet, the US could outlaw scraping and Russia would keep doing it.

We already have ways to deal with badly behaving countries.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#408

Post by tracker1 »

b65e8bee43c2ed0 wrote: post #62
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.

If you're willing to do it, a real browser with playwright is enough.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#409

Post by petu »

geysersam wrote: post #346
petu wrote: post #93

Earlier quoted context omitted.

> but unless you do PoW (which is also ecologically a nightmare) Can you expand? I don't see a problem with some napkin math. 5W load for 2 seconds is 0.002Wh (we have to let smartphones pass and not by doing PoW for 10s of seconds). 8 billion checks a day for a year = 8GWh.

8 billion checks per day sounds on the low end. I can imagine it being ten or hundred times more. That still seem pretty fine though. On the other hand, it's hard to see that such a modest energy cost would dissuade any attacks.

> I can imagine it being ten or hundred times more

I don't think I average even 2 captchas a day being terminally online, so 10 across every soul in the world sounds way too much for me. (we're ignoring bots it's meant to deter?)

> it's hard to see that such a modest energy cost would dissuade any attacks.

It's not against targeted attacks, but scrapping.

And not about energy cost, but available compute power -- it requires scrapper to use browser with JS (or time commitment to reimplement PoW outside of JS), limits their request rate by CPU core count.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#410

Post by rplnt »

GoblinSlayer wrote: post #371
aboardRat4 wrote: post #301

Earlier quoted context omitted.

>, I'd rather not even visit the site in the first place Until your bank, airline, and tax ministry start using them.

I vote with my wallet and dump misbehaving banks.

Overwhelming majority of customers doesn't even know they can care. And most of them wouldn't anyway. So your vote doesn't matter to anyone but you, sadly.
Post reply on HN