Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocked by Cloudflare

jrhawley.ca

Post reply on HN
Print view View original

171–180 of 473 posts

Re: Blocked by Cloudflare

#171

Post by NicoJuicy »

mlyle wrote: post #140
NicoJuicy wrote: post #61

Earlier quoted context omitted.

That's not a lot of information for such a complex subject. Eg. If you live in a dictatorship and use a VPN. You're traffic is together with a lot of people. The website owner can disable cloudflare their checks and that will leave their site unprotected. The choice of that is up to the website owner, no?

It seems like a lot of people are pretending that because there's a contractual relationship between Cloudflare and many websites, that Cloudflare can't cause outsized harms to other parties. It really sucks for a third party to claim you're a bot and as a result you lose access to resources. And the potential for harm is only increasing. Worse still, the false positive rate appears unacceptably high (look at all the…

Tbh. There's a lot of technical folks, worldwide, here. That's a lot of edge cases in comparison.

And their technical skills probably skews perception ( exotic browsers, behavior, VPN, Tor, ... )

As such, can you say, by indication, what percentage of web surfers "a lot" is? ( = Including non technical)

I don't disagree that people can have problems. I'm just wondering how representative "a lot" in reality is.

Re: Blocked by Cloudflare

#172

Post by p1mrx »

tomschlick wrote: post #169
p1mrx wrote: post #116

Earlier quoted context omitted.

> any service such as Cloudflare would need to be extremely aggressive in blocking Cloudflare needs an algorithm to deduce the IPv6 prefix size controlled by a given entity, but the details of that algorithm are not obvious. You are jumping to the conclusion that they must be doing a bad job because the problem is challenging. IPv4 abuse detection is also challenging because of (e.g.) the prevalence of CGNAT with mul…

I would imagine they have a list of the default / max DHCPv6 blocks that ISPs hand out. They are generally public knowledge so it would be easy for them to say Comcast hands out /56 so when blocking they block at that level for the ASN.

It probably makes more sense to derive that information from measurements. There are a lot of ISPs in the world, and allocation policies can change, even if you manage to find a person who knows what they are.

Re: Blocked by Cloudflare

#173

Post by warrenm »

dmix wrote: post #147
dcow wrote: post #84

So many privacy nuts use Chrome and don't realize this: > What about Google Chrome? > I tried all of the above in Firefox. So I naturally tried to access the same page in Google Chrome to see if I’d still be blocked. Thankfully, I wasn’t. > But of course I wasn’t because Chrome doesn’t have the same privacy- and security-enhancing designs that Firefox does. Chrome will happily collect as much private information abou…

> If you care about anything these days, don't use Chrome. Or Cloudflare.

funny enough... I called out Cloudflare for the pariah it is, and got downvoted and flagged

Re: Blocked by Cloudflare

#174

Post by factormeta »

deadbunny wrote: post #127
afavour wrote: post #96

Earlier quoted context omitted.

I’m no Google fanboy but I wasn’t satisfied with this: > Chrome will happily collect as much private information about me and my browsing history and share them with select parties, as needed What information does Chrome provide in this scenario that Firefox doesn’t? It feels like backward logic: it worked in Chrome therefore it must be because Chrome gave extra info. In reality it could be a whole bunch of things, s…

You're conflating a downside of using Chrome and the reason they think Cloudflare blocked them.

seems like the author mentioned that in FireFox disabling "privacy.resistFingerprinting" worked. So looks like Chrome by default is allowing the server to collect Fingerprinting. If cloud flare is using that, then it is a big red flag.

Re: Blocked by Cloudflare

#175

Post by blocked-by-cf »

adammartinetti wrote: post #65
AegirLeet wrote: post #13

I've had the exact same problem for a while. Here are some of the sites I've been unable to access (found by searching for "just a moment" in my browser history): - https://gitlab.com/users/sign_in - https://steamdb.info/login/ - https://www.zabbix.com/forum/ - https://casetext.com/ - https://namemc.com/login - https://spinroot.com/ - https://camelcamelcamel.com/ It's really annoying and Cloudflare is apparently doin…

Would you be willing to share a rayID you see during one of these looping challenges? I'm the PM for Cloudflare's challenge platform, and we'd love to look into this. RayIDs contain no PII so you can share publicly, or feel free to drop me an email at amartinetti at cloudflare. We'll also release a reporting mechanism soon, so in the future you can let us know when you see these issues and we can react to them quickl…

I also cannot access my VPS provider when using firefox.

ray id 7f3a169d4e630306

I previously had the same problem with ungoogled-chromium as well (regular chromium worked), but I guess it works now after 2-3 loops.

Re: Blocked by Cloudflare

#176

Post by buro9 »

Animats wrote: post #103
buro9 wrote: post #37

Earlier quoted context omitted.

I've been experiencing the PayPal one for a while. Firefox on Windows, Linux or Android. Thankfully the app is still signed in, but I've used credit card for things that I have PayPal money just sitting there ready to spend as I can't get into PayPal on Firefox.

Time to switch from PayPal to FedNow. FedNow is run by banks and the Fed, which are regulated as to whom they can refuse to server.

Never seen an online shop accept that, nor do I know if it's open to UK citizens. But thanks

Re: Blocked by Cloudflare

#177

Post by warrenm »

llm_nerd wrote: post #162
lambda wrote: post #157

Earlier quoted context omitted.

And even when it doesn't block you completely, it delays website loading, makes you jump through frustrating captchas, etc. It's probably third in the list of frustrating web behaviors in the past couple of years (behind GDPR popups and registration/paywalls that seem to have gotten much worse recently). And somehow there are some sites that I get CF delay walls on every time I visit. This feature is utterly broken f…

It's worth noting that the websites that you are visiting chose Cloudflare, and have enabled the features that irritate you. They have browser integrity enabled, have bot protection enabled, maybe turned the security level up (gitlab famously is a nuisance because they lean heavily on Cloudflare for protection). Sometimes they've wholly barred VPNs or entire geographic areas! And that is entirely the decision of webs…

And every Cloudflare customer is a company I won't do business with (unless there is absolutely no way around it)

Cloudflare is running the single biggest, most blatant man-in-the-middle attack in history, and far too many people are happy about it

Re: Blocked by Cloudflare

#178

Post by bcoates »

dmix wrote: post #149
executesorder66 wrote: post #132

Earlier quoted context omitted.

> So many privacy nuts use Chrome Really? That's news to me.

Well, Chromium is quite popular with the security conscious on Linux. At least it was when I was using ArchLinux, they had some good custom build script versions.

Some particular build of Chromium and Chrome are vastly different systems. A lot of this is philosophical; The Mozilla way is to support standards and tut-tut at websites for doing overtly malicious things like looking at user-agent or asking for widevine, the Chromium way is to treat the web as a hostile actor and offensively subvert anti-user behaviors.

Any modern browser that doesn't actively fingerprint as either most-common Chrome on a laptop, most-common Android browser, or most-common iPhone is written by such hopelessly naïve nerds that they shouldn't be trusted with user-facing software with real security considerations.

Re: Blocked by Cloudflare

#179

Post by jwatte »

dcow wrote: post #84

So many privacy nuts use Chrome and don't realize this: > What about Google Chrome? > I tried all of the above in Firefox. So I naturally tried to access the same page in Google Chrome to see if I’d still be blocked. Thankfully, I wasn’t. > But of course I wasn’t because Chrome doesn’t have the same privacy- and security-enhancing designs that Firefox does. Chrome will happily collect as much private information abou…

I don't quite understand the "ads it deems necessary for me to see" comment. You will always get ads on sites that serve ads. The thing the tracking might do, is change which particular ads you get. The right solution to that, is to use an ad blocker, and to pay for sites that have an ad-free alternative.

Also, fingerprinting isn't always "bad" -- any business who takes credit cards online, wants to try to exclude people who will commit fraud (because they might have done it before.) Preventing fingerprinting, means you prevent certain anti-fraud, which means that you see higher prices and more friction doing commerce online, which also affects your experience. The connection is just much less direct.

Re: Blocked by Cloudflare

#180

Post by veave »

flangola7 wrote: post #104
michaelt wrote: post #68

Earlier quoted context omitted.

Sadly, the fact a given site works for you or me is no guarantee it works for someone else. These bot detection systems tend to use all manner of imprecise statistical heuristics and weird fingerprinting. Perhaps AegirLeet has a graphics card that a popular web scraper pretends to have. Maybe they're in a suspicious timezone. Maybe they've installed a font usually only found on a different operating system. Maybe I'm…

Fingerprinting is scarily accurate now, strangely. https://fingerprint.com/

As a data point, enabling privacy.resistFingerprinting on Firefox defeats this website.
Post reply on HN