Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

181–190 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#181
post #167

Earlier quoted context omitted.

>that 200ms rtt does matter to users. it becomes very noticeable. especially when you're writing an app, not a brochure site. You need to tree shake so you're not serving a huge spa all at once. Because this implies that.

No it doesn't. at all. Page load speeds by themselves can be painful. Open devtools and have your browser throttle to poor 3g speeds. Try browsing around. even well optimized sites. Now try uploading a couple dozen files through an api. This is legit what some users deal with. In New York state even, you don't need to go that far to find poor connectivity. Even if all your users have awesome home connections, think s…

Then what does the 200ms have do with "writing an app"?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#182
post #153

The way I'd put it is that Cloudflare's suggested implementation may have its issues, but the general idea of trying to verify that someone is a human and then providing this verification to services in a way that is 1) anonymous and 2) cross-compatible with other services, is the correct way to go about things (or at least has some very appealing features). I hope that we have something in the future that does this…

Alternatively, if services demand a fee then there is no need for human verification. Instead of trying to solve anonymous human verification we can as well make micro-payment an option.

Sometimes serving 429s/403s to unauthed users is already costing you too much in egress bandwidth bills. That’s one of Cloudflare’s main propositions: stop that “idiot bot that will never get what it wants, but keeps requesting it anyway” traffic outside your network. (Note: not the same as a DoS! Usually not intentional, and usually not actually bringing your infra down. Just costing you money, while not making you any money.)

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#183
post #72
post #33

Earlier quoted context omitted.

Is it pretty much dead? Yeah, if you’re moving FAANG level traffic you need something more fancy than LAMP + an internet connection, but I’ve seen dozens and dozens of sites with a plain old no-cdn, no-pdn, LAMP tech stack. Working with startups might bias your view - lots of companies are running extremely boring setups and they work just great.

Respectfully, I think you miss the point. The fact that 98% of traffic goes trough this new infrastructure, allows some still plug their server to the net raw and their traffic still gets trough.

The traffic goes through this "new infrastructure" not out of necessity but because it's free and allows the user to pretend like a number of problems don't exist.

Terrestrial optical networks operate far, far below capacity to create artificial scarcity, which is to a certain extent necessary to recoup the capital expenditures in a competitive market, and is to a certain extent an abuse of an under-regulated natural monopoly.

If you could eliminate all adversarial factors and put every data service subscriber's payment for a single month into a pool, and that pool purchased only transceivers, passive optics and switches, and this hardware was distributed to every network operator perfectly fairly based on its contribution to the global maximization of available network capacity, then the delivered capacity to the end user could increase by something like 4.5 orders of magnitude with no substantial change in topology or subscriber or provider costs afterwards using the existing fiber, with a few more orders of magnitude possible with a fatter tree before the backbone costs explode.

With DWDM you can carry 100+ channels of 100Gbps over a single fiber today, with commodity, off the shelf components. Most fiber in the ground today is probably still lit with a single wave of 10G, if it's not just dark.

This distribution model is not even remotely a technical necessity, it's an arbitrary local minima reached largely by exploitative market distortions and adversarial economics.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#184
post #10

There's always CAPTCHA bypasses if you're willing to pay, there've been sites operating for decades that will take a captcha URL and spit out the appropriate response by just feeding it to humans. This is just a different way to make you pay - and arguably to something of less ill-repute, buying more U2F keys once yours get banned. This provides effective rate limiting and you can still get every key you automate ban…

this is what the blog post fails to address. Is the FIDO2 hardware key approach abusable? Yes. More so than regular image based CAPTCHA? No, like you said, there are well established services for "mechanical-turking" away the problem.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#185

Cloudflare captchas in particular, and any checks and roadblocks to see something publicly available in general, are terrible, period. It doesn't matter which form they take. Every time you see one you feel like a second-class citizen and get reminded that the internet is no longer what it used to be. I personally simply close the tab when I see a cloudflare "one more step" page.

what? Have you ever dealt with a DDoS attack and the consequences on your availability and infra health?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#186
post #170

Earlier quoted context omitted.

All users are hostile users and all users are preferred users. Define what your system will allow through rate limits and caching. Assume users would destory your site if given the chance because they will. If you are exposing private data through graphgl config it or drop the private data or drop graphgl and user a backend.

I 100% agree you should be looking at all incoming traffic as hostile or at least potentially hostile. The other comments are contending that there's nothing a hostile user could do to a 'public' page. One of the things using cloudflare gets you is all those protections without having to know how to do them yourself. Which a lot of the developers don't know how to do. There's also something to be said for catching a…

If you use cloudflare you give up freedom not to force captcha. If you avoid them you can choose where you want to captcha. When cloudflare goes down you go down unnecessarily.

If worried about a ddos attack cloudflare or another provider might be a good choice. But adding ddos support by default seems unncessary. In my 20 years of running 100s of sites I haven't run into a situation where I need ddos support. The vast majority will never be the target. Once in awhile google or bing will ddos you but using cloudflare to block that seems like overkill.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#187
post #181

Earlier quoted context omitted.

No it doesn't. at all. Page load speeds by themselves can be painful. Open devtools and have your browser throttle to poor 3g speeds. Try browsing around. even well optimized sites. Now try uploading a couple dozen files through an api. This is legit what some users deal with. In New York state even, you don't need to go that far to find poor connectivity. Even if all your users have awesome home connections, think s…

Then what does the 200ms have do with "writing an app"?

Apologies, your username looks like the one that tossed that number out as a what they assumed was a high number.

200ms latency isn't that bad, but I'm seeing more 800-2000ms latencies with some users depending on physical location. at some point latency kills usability. Especially when trying to get through a complicated QA or inventory process.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#188
post #137

Earlier quoted context omitted.

If you are building a search engine and getting blocked you can always contact me and I'll make sure that the teams that work on bot detection and DDoS are aware. We would like to know because we should not be blocking a legit crawler like this.

What's the best way to contact you?

jgc @ cloudflare

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#189
post #138

Earlier quoted context omitted.

No offense, this framing is so dumb. I hate it. The ‘Internet 3.0’ isn’t coming because of Cloudflare. It’s coming because these monolith big tech companies have an army of engineers who have been centralizing and building it this way for years. Cloudflare didn’t build these walls, it’s more of a giant boat now navigating it because other companies have no choice. I like to think of them as giant data ferryman in thi…

Clearly Cloudflare isn't responsible for the data centralization that is corrupting the internet. They are however, a very sophisticated and efficient enforcer of those policies. They've helped ensure large portions of the web is no longer crawlable, and that serves to consolidate information and power in those tech monopolies.

why is it assumed the web ought to be crawleable?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#190
post #170

Earlier quoted context omitted.

All users are hostile users and all users are preferred users. Define what your system will allow through rate limits and caching. Assume users would destory your site if given the chance because they will. If you are exposing private data through graphgl config it or drop the private data or drop graphgl and user a backend.

I 100% agree you should be looking at all incoming traffic as hostile or at least potentially hostile. The other comments are contending that there's nothing a hostile user could do to a 'public' page. One of the things using cloudflare gets you is all those protections without having to know how to do them yourself. Which a lot of the developers don't know how to do. There's also something to be said for catching a…

There are tradeoffs, yes.

We might weight those tradeoffs differently. That's ok.

Post reply on HN