Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocked by Cloudflare

jrhawley.ca

Post reply on HN
Print view View original

161–170 of 473 posts

Re: Blocked by Cloudflare

#161

Post by amatecha »

ricardo81 wrote: post #156
WheatMillington wrote: post #145

Earlier quoted context omitted.

You're being a little dramatic. It's incredibly unlikely that millions of innocent users have been blocked, and unless you have data to the contrary you shouldn't make such a claim. You know what else is harmful to the concept of the open internet? The enormous malicious botnets and other endemic problems that require a solution like CloudFlare.

> It's incredibly unlikely that millions of innocent users have been blocked Is there a 'town square' where we can talk about being presented captchas and similar things from 3rd party intermediates. I think it's incredibly likely that millions of hours have been wasted on such challenges.

On that note...

https://www.folklore.org/StoryView.py?project=Macintosh&stor...

"Well, let's say you can shave 10 seconds off of the boot time. Multiply that by five million users and thats 50 million seconds, every single day. Over a year, that's probably dozens of lifetimes. So if you make it boot ten seconds faster, you've saved a dozen lives. That's really worth it, don't you think?"

Imagine if people still thought like this about computers and software.

Re: Blocked by Cloudflare

#162

Post by llm_nerd »

lambda wrote: post #157
shiomiru wrote: post #129

Earlier quoted context omitted.

The cause of the problem is that your software is faulty by design. 1. IP addresses are to be used for packet routing. Certainly not for assigning "behavior scores" to users in the background. IP addresses say nothing about your visitors, my IP address could have been a complete stranger's IP address yesterday. 2. Deciding who can access half the web based on their TLS signature achieves nothing in the long run excep…

And even when it doesn't block you completely, it delays website loading, makes you jump through frustrating captchas, etc. It's probably third in the list of frustrating web behaviors in the past couple of years (behind GDPR popups and registration/paywalls that seem to have gotten much worse recently). And somehow there are some sites that I get CF delay walls on every time I visit. This feature is utterly broken f…

It's worth noting that the websites that you are visiting chose Cloudflare, and have enabled the features that irritate you. They have browser integrity enabled, have bot protection enabled, maybe turned the security level up (gitlab famously is a nuisance because they lean heavily on Cloudflare for protection). Sometimes they've wholly barred VPNs or entire geographic areas! And that is entirely the decision of website operators, and note that they did all of this before Cloudflare came along.

Cloudflare's customers are website operators, not you the end user. Those website operators seem pretty pleased with the service, so clearly they are doing a good job for the people who they are building it for.

Re: Blocked by Cloudflare

#163

Post by ricardo81 »

amatecha wrote: post #161
ricardo81 wrote: post #156

Earlier quoted context omitted.

> It's incredibly unlikely that millions of innocent users have been blocked Is there a 'town square' where we can talk about being presented captchas and similar things from 3rd party intermediates. I think it's incredibly likely that millions of hours have been wasted on such challenges.

On that note... https://www.folklore.org/StoryView.py?project=Macintosh&stor... "Well, let's say you can shave 10 seconds off of the boot time. Multiply that by five million users and thats 50 million seconds, every single day. Over a year, that's probably dozens of lifetimes. So if you make it boot ten seconds faster, you've saved a dozen lives. That's really worth it, don't you think?" Imagine if people still thoug…

Yes. And cookie splash screens! I admire GDPR's intention but hasn't it been a massive human time sink.

Not to take away from your point, just that it's all a hindrance.

Re: Blocked by Cloudflare

#164

Post by derefr »

alex7734 wrote: post #93
derefr wrote: post #20

If you've ever tried to take apart Cloudflare's various session cookies, MITMed scripts sent for "high integrity" pages (or when in "super bot-fight" mode), etc., you'll have observed that it's basically running a web-worker to heuristically do browser-integrity checking. That is, Cloudflare is trying to run a series of tests that real browsers operated by users pass, but which headless browsers operated by bots will…

> Why? Because telling a bot they've failed tells them that they should stop trying something that's not working In my humble opinion if your bot is stuck in a CloudFlare loop for 10 minutes that's a pretty strong signal that something's not working...

Keep in mind that a bot will be picking some permutation of its stock library of UA+metrics info, and generating truly-random values for other more continuously-valued parameters (e.g. timing between actions), to try to find a combination that satisfies a backend integrity-check.

A "try again" just means "you haven't succeeded yet." If that's all you get, you're getting zero bits of new information — so you can't do anything other than to assume it was your timing that looked weird, and keep trying. (And you might be dealing with even more noise, e.g. trying to have the bot calibrate itself toward a very low human-tuned request rate limit, where above-rate-limit responses look no different than integrity-fail "try again" responses.)

Suddenly getting a (maybe permanent) hard-fail, meanwhile, means that you said something the integrity-checker really didn't like.

Presuming you have a lot of IP addresses to send requests from, you can then do many experiments to bisect the difference between a hard-fail and soft-fail, and use that to blacklist values from your UA+metrics library. It's free entropy!

Re: Blocked by Cloudflare

#165

Post by grishka »

ricardo81 wrote: post #163
amatecha wrote: post #161

Earlier quoted context omitted.

On that note... https://www.folklore.org/StoryView.py?project=Macintosh&stor... "Well, let's say you can shave 10 seconds off of the boot time. Multiply that by five million users and thats 50 million seconds, every single day. Over a year, that's probably dozens of lifetimes. So if you make it boot ten seconds faster, you've saved a dozen lives. That's really worth it, don't you think?" Imagine if people still thoug…

Yes. And cookie splash screens! I admire GDPR's intention but hasn't it been a massive human time sink. Not to take away from your point, just that it's all a hindrance.

Those can at least be blocked with ad blockers and/or disabling JS.

Re: Blocked by Cloudflare

#166

Post by jeroenhd »

tomxor wrote: post #131
jeroenhd wrote: post #114

Earlier quoted context omitted.

Cloudflare's Privacy Pass may help here: https://privacypass.github.io/ It should significantly reduce the amount of CAPTCHAs you see in a way that's not terrible for privacy. For Safari, you can enable Private Access Tokens: https://blog.cloudflare.com/how-to-enable-private-access-tok... Both of these mechanisms are similar to Google's web DRM proposal in that they rely on external issuers to generate tokens, but un…

Wow, that doesn't sound like a terrible idea! Which is honestly surprising in this area where it feels like privacy, anonymity and human verification are incompatible with each other. I am trying to minimise my time wasted by websites, which is hard to balance with privacy, one other one is the repetitive consent forms (if you don't retain cookies, it's a never ending process). I think consent forms and human verific…

> Which is honestly surprising in this area where it feels like privacy, anonymity and human verification are incompatible with each other.

The thing is, it still allows for some correlation between attestation provider and the websites themselves, potentially exposing part of your browsing history to these companies based on how many tokens you use and what websites consume them.

That doesn't matter much for Cloudflare's implementation (now Cloudflare knows when you visit Cloudflare, oh no!) but with Apple's attestation provider the risks increase. The smaller the attestation provider gets or the fewer parties trust that particular attestation provider, the higher the risk becomes.

It's better for your privacy than the current norm (de-anonimisation through fingerprinting while you fill out a CAPTCHA) but it's still not great. It also allows for attestation providers (and their algorithms) to arbitrarily deny you access to the web if other websites decide to start using them.

Privacy in exchange for power, I'm not so sure about that. I imagine for someone suffering from ADHD the small risk that Cloudflare decides to screw you in particular is worth the massive improvement in browsing experience, but everyone will have to determine the pros and cons for themselves.

Re: Blocked by Cloudflare

#167

Post by rvnx »

ricardo81 wrote: post #163
amatecha wrote: post #161

Earlier quoted context omitted.

On that note... https://www.folklore.org/StoryView.py?project=Macintosh&stor... "Well, let's say you can shave 10 seconds off of the boot time. Multiply that by five million users and thats 50 million seconds, every single day. Over a year, that's probably dozens of lifetimes. So if you make it boot ten seconds faster, you've saved a dozen lives. That's really worth it, don't you think?" Imagine if people still thoug…

Yes. And cookie splash screens! I admire GDPR's intention but hasn't it been a massive human time sink. Not to take away from your point, just that it's all a hindrance.

@adammartinetti : maybe you could consider developing a new product where you display a GDPR consent banner once, and then these settings apply to all Cloudflare-proxied websites (by passing this consent information as an additional header to the proxied site)

Re: Blocked by Cloudflare

#168

Post by skybrian »

Fingerprinting is probably load-bearing for captchas and other anti-fraud stuff that many Internet services and businesses depend on:

https://xkcd.com/2347/

It should be replaced with something better. Unfortunately all attempts to do something better get attacked by people who don’t realize that you can’t just get rid of it, or important things will break.

Re: Blocked by Cloudflare

#169

Post by tomschlick »

p1mrx wrote: post #116
MichaelZuo wrote: post #4

This is a bit tangential to the author's point but it does seem to indicate that IPv6 is mostly pointless for human users for exactly this reason. Since it's so much easier to hide behind a new unique address, compared to IPv4, that any service such as Cloudflare would need to be extremely aggressive in blocking to meet their internal metrics and customer advertised minimum thresholds. So much so that it actually cos…

> any service such as Cloudflare would need to be extremely aggressive in blocking Cloudflare needs an algorithm to deduce the IPv6 prefix size controlled by a given entity, but the details of that algorithm are not obvious. You are jumping to the conclusion that they must be doing a bad job because the problem is challenging. IPv4 abuse detection is also challenging because of (e.g.) the prevalence of CGNAT with mul…

I would imagine they have a list of the default / max DHCPv6 blocks that ISPs hand out. They are generally public knowledge so it would be easy for them to say Comcast hands out /56 so when blocking they block at that level for the ASN.

Re: Blocked by Cloudflare

#170

Post by jeroenhd »

Ekaros wrote: post #122
paradox460 wrote: post #121

Earlier quoted context omitted.

I've seen the misconception a lot; people seem to think that random websites can grab your MAC like they can get your IP address.

MAC is a weird thing, it is important for ethernet to work efficiently. But in actuality it only travels to about next router from machine...

With WiFi, MAC addresses become more of an issue (as you're often scanning and roaming), but we have randomisation algorithms for that.

The same was true for IPv6 for a while, but that too has been solved a long time ago.

For a SLAAC client whose privacy extensions have been disabled for some reason, it's very much possible to figure out your MAC address. This may be a problem on old hardware that doesn't receive updates anymore!

Post reply on HN