Cloudflare Turnstile requiring fingerprintable WebGL • Hacker News Board

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#141

Post by binaryturtle » Sun, May 31, 2026, 5:55 PM UTC

jwr wrote: post #96

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#142

Post by megous » Sun, May 31, 2026, 5:55 PM UTC

They use all kinds of obscure APIs, which you'll learn if you're privacy/security conscious and disable random web APIs that are of no use to YOU as a web user, but only can ever serve the people who serve you stuff or want to hack you or track you.

Normally websites feature test and just skip using obscure disabled APIs, or more likely, websites don't use those APIs at all or only tracking scripts use it, which are already optional usually.

Problem with CF is that if you want increased security they'll prevent you from gaining it everywhere, even on sites they don't protect, or prevent you from accessing services even the ones you paid for. Browsers don't allow disabling APIs per domain, so you're either at risk everywhere or you're blocked from accessing a lot of things for no particular reason.

CF can't be bothered to feature test.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#143

Post by BoingBoomTschak » Sun, May 31, 2026, 5:56 PM UTC

4oo4 wrote: post #79

I tested this extension that I've been using for a long time on the turnstile page and it got through, fwiw. I think it's a bit more subtle than how resistfingerprinting works but not sure what the privacy tradeoff is. https://github.com/kkapsner/CanvasBlocker

Thanks for the report, I've been running this for a long time.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#144

Post by fsflover » Sun, May 31, 2026, 5:58 PM UTC

richwater wrote: post #26

fidotron wrote: post #16

Earlier quoted context omitted.

A better solution would be to make webgl, webgpu and (especially) webrtc have some sort of prompt before they can be in any way used in that fashion, but this will absolutely destroy web ux Windows Vista style.

You mean the "Accept Cookies" banner that has become a complete joke? Pass

This is actually illegal under GDPR.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#145

Post by queenkjuul » Sun, May 31, 2026, 5:59 PM UTC

dcrazy wrote: post #109

ndriscoll wrote: post #68

Earlier quoted context omitted.

Sell them via a Dutch auction. Eliminate the arbitrage opportunity for scalpers and make more money in the process.

That’s how you wind up with only kids of millionaires at your Taylor Swift concert.

So a Taylor Swift concert

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#146

Post by esrauch » Sun, May 31, 2026, 6:09 PM UTC

sandeepkd wrote: post #122

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecologically a nightmare), probably fingerprinting is the way to go - completely destroying the privacy of everyone involved. Bot protection with fingerprinting is just an illusion. Any signals like this which is on client side can be spoofed by an above average person.…

> Bot protection with fingerprinting is just an illusion. Any signals like this which is on client side can be spoofed by an above average person.

At the upper bound, fraud can always be committed by paying real people with real accounts to perform the desired action in a way that is 100% truly indistinguishable from organic. There's fundamentally actual prevention technique at the limit.

So the entire game is only "increasing the costs until it's not viable ROI", not "holistically prevent", which is why fingerprinting is a relevant technique here.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#147

Post by konform » Sun, May 31, 2026, 6:14 PM UTC

I'm maintaining a minority browser[0] and as of a couple of weeks this is affecting several of our users[1]. While I'm currently not considering this a browser bug (one could be involved, of course), more eyes are better and any help or ideas on improving or mitigating the situation would be appreciated.

[0]: https://konform-browser.codeberg.page/

[1]: Most? All? Without any telemetry, relying on user reports and our own testing here.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#148

Post by tardedmeme » Sun, May 31, 2026, 6:17 PM UTC

jwr wrote: post #96

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

It's just one more facet of the enshittoscene, the era where actual product quality is completely irrelevant. Put it in the same bucket as websites that lag when you scroll, apps that refuse to show you video without a huge play/pause button overlaid in the middle of it that never goes away, and the movie Melania. My hypothesis is that billion-dollar businesses no longer exist to sell things to customers, but only to impress other billionaires to get their investment money.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#149

Post by tardedmeme » Sun, May 31, 2026, 6:18 PM UTC

binaryturtle wrote: post #141

jwr wrote: post #96

Earlier quoted context omitted.

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."

Cloudflare will just tell them that 70% traffic drop is because 70% of their traffic was bots, and everything is working fine, and hey, don't you want to upgrade to a paid plan to block 50% of the remainder? Think about how many bots will be blocked with that upgrade!

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#150

Post by tardedmeme » Sun, May 31, 2026, 6:19 PM UTC

notafox wrote: post #85

PearlRiver wrote: post #32

Earlier quoted context omitted.

This is why I have two separate browsers. If you want to do official stuff like paying for things you need to get through cloudflare.

You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles. Firefox with a non-default profile can be created like that: ./firefox -CreateProfile "profile-name /home/user/.mozilla/firefox/profile-dir/" # For, say, cloudflare that would be: ./firefox -CreateProfile "cloudflare /home/user/.mozilla/firefox/cloudflare/" An…

They're blocking Firefox quite often. Stripe does something that makes Firefox hang. I use Chrome for those sites and then go back to Firefox...