Firefox appears to be flagged as suspicious by Cloudflare • Hacker News Board

Re: Firefox appears to be flagged as suspicious by Cloudflare

#21

Post by kd913 » Sat, May 21, 2022, 5:24 PM UTC

dingleberry420 wrote: post #18

zinekeller wrote: post #9

I think it's two-fold: rise of tools like curl-impersonate ( https://github.com/lwthiker/curl-impersonate ) and the very consistent Firefox TLS fingerprint across platforms. Unlike Chromium (where you could differentiate a Linux, Mac or Windows computer from its chiphers, and so for example challenge only Linux clients), Firefox has NSS and NSS is used everywhere the Gecko engine is used while Chromium, although has…

Quoted post unavailable.

I don't imagine it's deliberate.

A bunch of cloudflare engineers are long-term ex-servo, ex-mozilla given their experience on Rust.

Re: Firefox appears to be flagged as suspicious by Cloudflare

#22

Post by dingleberry420 » Sat, May 21, 2022, 5:25 PM UTC

kd913 wrote: post #21

dingleberry420 wrote: post #18

Earlier quoted context omitted.

Quoted post unavailable.

I don't imagine it's deliberate. A bunch of cloudflare engineers are long-term ex-servo, ex-mozilla given their experience on Rust.

No post body was provided.

Re: Firefox appears to be flagged as suspicious by Cloudflare

#23

Post by [deleted] » Sat, May 21, 2022, 5:26 PM UTC

dingleberry420 wrote: post #18

zinekeller wrote: post #9

I think it's two-fold: rise of tools like curl-impersonate ( https://github.com/lwthiker/curl-impersonate ) and the very consistent Firefox TLS fingerprint across platforms. Unlike Chromium (where you could differentiate a Linux, Mac or Windows computer from its chiphers, and so for example challenge only Linux clients), Firefox has NSS and NSS is used everywhere the Gecko engine is used while Chromium, although has…

Quoted post unavailable.

[deleted]

Re: Firefox appears to be flagged as suspicious by Cloudflare

#24

Post by detritus » Sat, May 21, 2022, 5:26 PM UTC

Aachen wrote: post #2

I mean, with that market share, popularity among open source fans... it's an easy group to target and filter oddballs. I'm a Firefox user and I'm used to this treatment at every step of the way, no matter if it's about software, airports, opening a bank account so I can receive a salary, etc. Fundamental things everyone wants to do are being made hard to do the right way. It's always anti privacy, anti self repair, a…

Really? I'm a firefox user too and whilst I occasionally bump into some situation as you describe where I need to hop onto Chrome, I genuinely can't remember the last time this happened. Nope, actually - sometime last year, with some poorly-coded gig ticket purchase thing, if I remember right. I was able to check the code and amend some stupid niggle in WebDev tools to get around it.

Not saying I should have to accept that, but that's what it was.

Certainly not 'regularly'.

Re: Firefox appears to be flagged as suspicious by Cloudflare

#25

Post by rezonant » Sat, May 21, 2022, 5:26 PM UTC

This is almost certainly a firewall rule put in place by the operators of that site. My own sites which are protected with Cloudflare do not exhibit this behavior when using Firefox.

Re: Firefox appears to be flagged as suspicious by Cloudflare

#26

Post by pjmlp » Sat, May 21, 2022, 5:27 PM UTC

robonerd wrote: post #16

We're regressing to a state reminiscent of the dark IE years. Except back then when you suggested alternative browsers, people were generally receptive once they saw the practical utility of features like tabs. Now when you suggest alternative browsers, people complain about tens of milliseconds more latency and insist on using Chrome for the speed. It's hard to blame them though, since the practical advantages of Fi…

Even if FOSS fans don't like it, it is iOS/Safari that is the last block preventing the Web platform to be finally renamed to Chrome OS.

Re: Firefox appears to be flagged as suspicious by Cloudflare

#27

Post by rezonant » Sat, May 21, 2022, 5:27 PM UTC

gfs wrote: post #3

I'd be curious to see if this is the case for other sites that use Cloudflare bot protection as well. There are a bunch of ways to tune the service so maybe they are just extra cautious?

It is definitely this. My websites on Cloudflare are not exhibiting this behavior with Firefox...

Re: Firefox appears to be flagged as suspicious by Cloudflare

#28

Post by dingleberry420 » Sat, May 21, 2022, 5:27 PM UTC

shaicoleman wrote: post #8

A workaround is to install the Privacy Pass extension to bypass the captchas [1] [2] It's an open source extension available for Chrome and Firefox. It allows to privately identify you're human, and is the process of going through IETF standardisation, so hopefully someday you won't need to install an extension for it. After you complete a captcha once, you won't need to do it again for a long time. I'm not happy abo…

Deanonymizing yourself just to appease cloudflare is not a valid solution. Any website should work in any browser out of the box. If they don't, the website is broken.

Re: Firefox appears to be flagged as suspicious by Cloudflare

#29

Post by Dylan16807 » Sat, May 21, 2022, 5:27 PM UTC

baisq wrote: post #6

Cloudflare uses a lots of heuristics to determine whether to show their challenge. In fact getting served a challenge says more about the amount of bot traffic that the website is getting than about how bot-like you look.

It might say "more" about how much bot traffic the site is getting, but it is also making some very clear statements about user agent. Those don't contradict at all.

Re: Firefox appears to be flagged as suspicious by Cloudflare

#30

Post by shaicoleman » Sat, May 21, 2022, 5:29 PM UTC

dingleberry420 wrote: post #28

shaicoleman wrote: post #8

A workaround is to install the Privacy Pass extension to bypass the captchas [1] [2] It's an open source extension available for Chrome and Firefox. It allows to privately identify you're human, and is the process of going through IETF standardisation, so hopefully someday you won't need to install an extension for it. After you complete a captcha once, you won't need to do it again for a long time. I'm not happy abo…

Deanonymizing yourself just to appease cloudflare is not a valid solution. Any website should work in any browser out of the box. If they don't, the website is broken.

"The blind signing procedure ensures that passes that are redeemed in the future are not feasibly linkable to those that are signed. We use a privacy-preserving cryptographic protocol based on ‘Verifiable, Oblivious Pseudorandom Functions’ (VOPRFs) built from elliptic curves to enforce unlinkability. The protocol is exceptionally fast and guarantees privacy for the user. As such, Privacy Pass is safe to use for those with strict anonymity restrictions."

1. https://privacypass.github.io/

> Deanonymizing yourself just to appease cloudflare is not a valid solution

I'm not claiming it is a valid solution, I'm just sharing a possible workaround.