Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocked by Cloudflare

jrhawley.ca

Post reply on HN
Print view View original

101–110 of 473 posts

Re: Blocked by Cloudflare

#101

Post by [deleted] »

bradly wrote: post #94
adammartinetti wrote: post #76

Hi there, I'm the PM for Cloudflare's challenge platform. I'd love to look into what the cause of the problem is, so you don't see these difficulties. > Cloudflare detected the high frequency of requests and denials (but not their faulty loop that caused this pattern of requests, of course), and tagged my browser as suspicious. I can tell you at least that we don't penalize users for this looping behavior, so this wo…

Anecdotaly... I use Firefox and have noticed the Cloudflare interception pages verifying I'm human appearing more often recently. Usually it is all automatic and isn't a big deal, but I have noticed a increase in how often I see these the past week.

[deleted]

Re: Blocked by Cloudflare

#102

Post by shadowgovt »

zer8k wrote: post #12

Any time a large portion of internet traffic is controlled by a single source it brings problems like this with it. All cloudflare has to do is arbitrarily decide who and who can't use the internet and effectively their word becomes law. Like most things it starts with an innocent premise (e.g. "an easy way to stop bad actors") and ends up extended to any number of arbitrary things. Worse, the argument from privacy a…

The current internet is nothing like the internet of 20 years ago.

Re: Blocked by Cloudflare

#103

Post by Animats »

buro9 wrote: post #37
thedanbob wrote: post #16

Just yesterday I realized that I couldn't log into Paypal on Safari or Firefox, only a Chromium-based browser. We're getting deeper all the time into "this site is best viewed in Google Chrome".

I've been experiencing the PayPal one for a while. Firefox on Windows, Linux or Android. Thankfully the app is still signed in, but I've used credit card for things that I have PayPal money just sitting there ready to spend as I can't get into PayPal on Firefox.

Time to switch from PayPal to FedNow. FedNow is run by banks and the Fed, which are regulated as to whom they can refuse to server.

Re: Blocked by Cloudflare

#104

Post by flangola7 »

michaelt wrote: post #68
zer8k wrote: post #23

Earlier quoted context omitted.

I haven't had any problems on Waterfox. However, it is absurd to me I need javascript to simply visit a website anymore.

Sadly, the fact a given site works for you or me is no guarantee it works for someone else. These bot detection systems tend to use all manner of imprecise statistical heuristics and weird fingerprinting. Perhaps AegirLeet has a graphics card that a popular web scraper pretends to have. Maybe they're in a suspicious timezone. Maybe they've installed a font usually only found on a different operating system. Maybe I'm…

Fingerprinting is scarily accurate now, strangely. https://fingerprint.com/

Re: Blocked by Cloudflare

#105

Post by w0ts0n »

elashri wrote: post #59
Temporary_31337 wrote: post #30

Earlier quoted context omitted.

If you don’t want to stop using CloudFlare or need a temporary solution ask your users from Egypt to use VPN- many already do as they come across similar problems for other services

Egypt do block VPNs in much more aggressive way than Cloudflare. Also this is my first time to hear that cloudflare is blocked in Egypt. People will even complain that they cannot connect to their cooperate VPNs. Blocking cloudflare ip addresses means that half of the internet wouldn't be accessible from Egypt. its closw to blocking port 443 because some people use DNS over https. disclaimer: I'm Egyptian living in t…

Have someone in Egypt look at our site. Its been blocked for about 3 months.

Apparently there is a pool of IP's that Cloudflare use for their CDN and some of them are blocked in Egypt. If you are unlucky enough to be one of the websites that is using that IP, it's blocked. Apparently they rotate them, but I haven't seen it yet, so chances are, when they do rotate them, more will be blocked.

Re: Blocked by Cloudflare

#106

Post by unmole »

AegirLeet wrote: post #13

I've had the exact same problem for a while. Here are some of the sites I've been unable to access (found by searching for "just a moment" in my browser history): - https://gitlab.com/users/sign_in - https://steamdb.info/login/ - https://www.zabbix.com/forum/ - https://casetext.com/ - https://namemc.com/login - https://spinroot.com/ - https://camelcamelcamel.com/ It's really annoying and Cloudflare is apparently doin…

I can access them all fine using Firefox on Android.

Re: Blocked by Cloudflare

#107

Post by jrockway »

CuriousCosmic wrote: post #97
adammartinetti wrote: post #76

Hi there, I'm the PM for Cloudflare's challenge platform. I'd love to look into what the cause of the problem is, so you don't see these difficulties. > Cloudflare detected the high frequency of requests and denials (but not their faulty loop that caused this pattern of requests, of course), and tagged my browser as suspicious. I can tell you at least that we don't penalize users for this looping behavior, so this wo…

FWIW I see this with Firefox when I route my traffic through ProtonVPN. It could be caused by someone else's bad behavior on the VPN but I'd hazard a guess that it's more than that.

I've definitely seen this from time to time. I used to work for an ISP and we would occasionally, in the office, get "Your system is sending too many automated requests" from Google. Usually one of our customers had gone off the rails with some sort of amateur scraping, but this was always a pain to debug. I think we talked with Google's NOC and just had our rate limit increased or something like that.

Re: Blocked by Cloudflare

#109

Post by unmole »

bradley13 wrote: post #78

Anecdote: For my programming classes, one example I use is a simple browser. It doesn't do CSS or Javacript, so display is primitive, but it works. On some sites. Many sites, especially the big ones, see that it's an unknown browser, and refuse to send content. Probably they think it's a bot. But even if it were, what's wrong with bots, as long as they're well-behaved? What kind of closed web have we let the megacorp…

Playing the devil's advocate: Why shouldn't a server get to decide which clients it wants to talk to?

Re: Blocked by Cloudflare

#110

Post by jeroenhd »

Some comments I have on this post:

> Worse yet, I know that Cloudflare knows I have those certificates. Why? Because it asked for them!

Not really. Cloudflare notices your browser has TLS authentication available and asks you for it. That's really annoying, but part of the protocol spec. Your browser won't send this information unless you pick a certificate and hit OK.

Disable your ad blocker and you'll find that many trackers will also ask you to identify yourself this way. It's really annoying, browsers need to design better UX for this type of authentication.

> · MAC address of my machine that I have previously used to access this site

How does it gather your MAC address? Did you disable IPv6 Privacy Extensions? Unless the website is sitting behind the same switch as your computer or you run some kind of native application that sends the MAC address, websites can't read the MAC of your network interface. Enable the MAC randomisation that's present (sometimes even turned on by default!) in every modern OS if you consider the local switch or WiFi network to be a privacy risk.

> Will I be able to create and sync these passkeys myself?

Yes, assuming they follow the standard

> Can only certain types of software use passkeys? If so, who decides what software meets this standard?

I don't really understand the question. Any software supporting passkeys will be able to prompt you for generating or using a passkey.

> Will I only be able to generate passkeys on a device with specific hardware/software requirements like a TPM, DeviceCheck, or Integrity API?

According to the spec, keys can be stored in software no trouble. Websites and apps can ask for securely generated keys, but I don't think those are all that common. Hardware can also be faked relatively easily in most circumstances.

> Can I, at any time, export my passkeys from one service provider and switch to another provider?

Ask your service provider for export options. Most likely, you can't just dump the keys and import them elsewhere (that would defeat the point).

> If a passkey is invovled in a suspicious event, will that suspicious mark propogate to any other device that uses that same passkey? Do devices that contain suspicious passkeys also get marked as suspicious? If so, would that impact the ability of that device to access other independent websites?

That depends on the software using the key for authentication. Maybe?

Post reply on HN