Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

11–20 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#11

Post by kylehotchkiss »

kylehotchkiss wrote: post #7

I’d rather take these tradeoffs than doing 5 steps of Recaptcha because I’m using a VPN to work, which as Cloudflares announcement said, is very localized to North America and likely extra complicated for those outside the region. In theory, couldn’t Yubikey begin reducing batch sizes to 1,000 and Cloudflare mark specific batch numbers as requiring one extra step to verify? The vast majority of Yubikey sales will be…

And if Yubikey could reduce batch sizes - could they require bulk non-wholesale orders to retain the same batch ID to reduce likelihood of abuse?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#12

Post by thejosh »

Cloudflare is both a great thing and a terrible thing that has happened to the internet in recent years.

Great in that they have a fantastic UI to add your site in, basically shielding the average user from attacks.

Bad from a standpoint of that now only Google, Bing, and maybe other big search engines have the capabilities to actually crawl the internet now.

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#14

Post by arsome »

sdfhbdf wrote: post #8
arsome wrote: post #5

Earlier quoted context omitted.

I believe the idea here is you need to buy actual FIDO U2F keys and they could then be revoked on a per-key basis if you're caught abusing them as they're signed by a 3rd party so can't just be emulated. Meaning you need to buy more. Makes it expensive at least.

But i'm specifically asking about software. I know Touch ID can be used with WebAuthn and also see the DevTools in chrome WebAuthn debugger. Just seems easy to fool when I regenerate a key on every visit unless there is additional step I don't get.

You can't generate an attested key with the devtools. It won't be signed by a 3rd party that CloudFlare has approved.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#16

Post by arsome »

Nextgrid wrote: post #6
arsome wrote: post #5

Earlier quoted context omitted.

I believe the idea here is you need to buy actual FIDO U2F keys and they could then be revoked on a per-key basis if you're caught abusing them as they're signed by a 3rd party so can't just be emulated. Meaning you need to buy more. Makes it expensive at least.

How can you revoke on a per-key basis without at the same time being able to track keys uniquely?

I'm not terribly familiar with U2F itself, but I assume the site has a way to identify you're using the right key that can be reused for this purpose?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#18

Post by sdfhbdf »

arsome wrote: post #14
sdfhbdf wrote: post #8

Earlier quoted context omitted.

But i'm specifically asking about software. I know Touch ID can be used with WebAuthn and also see the DevTools in chrome WebAuthn debugger. Just seems easy to fool when I regenerate a key on every visit unless there is additional step I don't get.

You can't generate an attested key with the devtools. It won't be signed by a 3rd party that CloudFlare has approved.

Ok, you're right. I did miss a step!

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#20

Post by jgrahamc »

thejosh wrote: post #12

Cloudflare is both a great thing and a terrible thing that has happened to the internet in recent years. Great in that they have a fantastic UI to add your site in, basically shielding the average user from attacks. Bad from a standpoint of that now only Google, Bing, and maybe other big search engines have the capabilities to actually crawl the internet now. I don't see us getting a massive innovation in search on t…

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening.

How are we "stopping search innovation"?

Post reply on HN