Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

181–190 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#181

Post by arbol »

keynha wrote: post #154
adamtaylor_13 wrote: post #22

So if you need to prevent bot abuse, but also don't want an ugly captcha every time someone goes to sign up, is there a better option?

Behavioral signals are the usual answer: risk-scored, invisible challenges; proof-of-work (cost without identity, though it taxes mobile); and signup-velocity/rate limits that stop cheap abuse before any challenge fires. The reason fingerprinting wins anyway is that it requires less operator effort, not that it is the only thing that works.

Behavioural requires interaction. Fingerprinting is instantaneous and cloudflare runs on page load for lots of sites

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#182

Post by arbol »

ribtoks wrote: post #38
adamtaylor_13 wrote: post #22

So if you need to prevent bot abuse, but also don't want an ugly captcha every time someone goes to sign up, is there a better option?

Use proof-of-work captchas, many are private by default. Look into Private Captcha or Cap captcha.

PoW doesn't stop bots.. It's an annoyance at most. A rate limiter and nothing more

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#184

Post by xg15 »

ethin wrote: post #164
jwr wrote: post #96

Earlier quoted context omitted.

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

I don't think it's just privacy, it also increasingly turns the web itself into a walled garden. The end result is that websites can only ever be accessed by "approved" clients - the latest Chrome, Edge, Safari and if you're lucky Firefox - and nothing else.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#185

Post by arbol »

thayne wrote: post #133
gruez wrote: post #69

Earlier quoted context omitted.

Depends on what type of scraping you're trying to stop. For the dumb scrapers that would try to scrape every page on a git forge (for which there are a bazillion pages for a modest project, because of how the site works), yeah it might deter them enough to stop. For anything high value (eg. reddit comments or retail prices), 10s of cpu time isn't going to stop them.

If it's high value, there isn't really much you can do that will be completely effective. Traditional captchas can often be beaten by AI, or by "captcha farms" where impoverished people are paid pennies to complete captchas. Fingerprinting can be beaten by using a full browser to make the requests. Basically anything you do is just a matter of making it more expensive for bots to access it.

Beating fingerprinting and beating traditional captcha is far more expensive than solving pow. Pow doesn't stop anyone, not even the most novice bot operators

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#186

Post by tick_tock_tick »

tardedmeme wrote: post #23
aleksandrm wrote: post #12

Earlier quoted context omitted.

What gave you the impression that Cloudflare were the good guys?

Probably everyone on HN singing their praises for the past 10 years.

Pretty sure every thread has a massive chain about them being a NSA honey pot.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#187

Post by arbol »

phoronixrly wrote: post #57
ImPostingOnHN wrote: post #39

Earlier quoted context omitted.

The tool "Anubis" uses proof of work instead

How does Anubis stop bots?

It doesn't. It slows them down. To stop bots you need to employ the full suite of tools, fingerprinting, IP rep, behavioural analysis. Anubis will slow down your basic scrapers that try to crawl the entire web but it is useless against actual bots

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#188

Post by arbol »

thisislife2 wrote: post #33
Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

The only solution is regulation . If all content created by anyone has a copyright, how does an implicit opt-in (which is what happens if you don't create a robots.txt file for your website) for scraping make any sense? Moreover, even if you have a robots.txt, AI (or whatever) bots often don't respect it (or use workarounds - they outsource scraping of such "restricted" sites to unethical third-parties to get the dat…

Or the regulated agents standard that cloudflare is conveniently going to steward alongside Google...

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#189

Post by benhurmarcel »

gruez wrote: post #157
binaryturtle wrote: post #141

Earlier quoted context omitted.

I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."

>I wonder if the website owners realise at all how many actual users they lose by this sort of "protection." How many people do you think are browsing with a weird enough config (eg. custom browser like OP, or some weird config like firefox with fingerprinting protection on a raspeberry pi) to trip cloudflare's protection?

I got locked out of some websites by Cloudflare Turnstile on some very standard configurations, like an iPhone on Safari, or a Windows 11 desktop with Firefox or Edge, neither with a VPN on. I never found out why.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#190

Post by arbol »

spacedoutman wrote: post #29
Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

Private invite only internets

LAN parties?!
Post reply on HN