Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

211–220 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#211

Post by dotancohen »

CrimsonRain wrote: post #160
binaryturtle wrote: post #141

Earlier quoted context omitted.

I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."

I'm one of those who have enabled cloudflare on all of the sites I maintain. Additionally, Added turnstile on every form. I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. Recently I also hard blocked all IPs from china Singapore India Pakistan Russia and whole of africa. Do I want to do it? No. But the amou…

  > I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much.
So why not just shut down the website? Or remove the form entirely? That will ensure that you get no spam, right?

One of the core tenets of system design is Availability. If your service is not available - if your forms are blocking legitimate users - then why are you pretending to have a form submission feature at all? Just to frustrate users?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#212

Post by keynha »

arbol wrote: post #181
keynha wrote: post #154

Earlier quoted context omitted.

Behavioral signals are the usual answer: risk-scored, invisible challenges; proof-of-work (cost without identity, though it taxes mobile); and signup-velocity/rate limits that stop cheap abuse before any challenge fires. The reason fingerprinting wins anyway is that it requires less operator effort, not that it is the only thing that works.

Behavioural requires interaction. Fingerprinting is instantaneous and cloudflare runs on page load for lots of sites

[dead]

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#214

Post by dotancohen »

dcrazy wrote: post #106
denysvitali wrote: post #101

Earlier quoted context omitted.

I stand corrected. It's not a nightmare scenario (as for Bitcoins) - but I'm still of the idea that "useless" computations should be avoided (as we should avoid having 10MB websites). In any case, according to some napkin math done by Kimi 2.6 (which by itself is probably already consuming more than all of my PoW challenges for the upcoming 5 years) - the situation looks incredibly in favor of PoW: https://www.kimi.c…

Because it doesn’t solve the problem of residential botnets.

Neither does fingerprinting.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#215

Post by canyp »

jwr wrote: post #165
ethin wrote: post #164

Earlier quoted context omitted.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…

I second this. My website exposes a cgit and 99% of the traffic now is AI scraping the sources, but the load is nowhere near DoS territory. And this is running on the cheapest VPS I could find.

Not saying I'm not annoyed by the scraping; I am looking to block them, but I'm also not going to put the site behind the gatekeeper. If anything, Cloudflare must love AI scraping now for the same reason AV companies love malware.

Now, if you are running a PHP stack...yeah, maybe that's the problem right there.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#217

Post by dotancohen »

TkTech wrote: post #201
0x59 wrote: post #195

Earlier quoted context omitted.

Idk, if bots ate hammering your server then setup rate limits. If you have content that you don't want others to have access to, don't serve it with a webserver.

I used to just start giving any IP downloading way too much a redirect to multi-tb NASA images. This was a long time ago but it was surprisingly how many would follow redirects and never time out. Wouldn't see a request again for hours and then its right back to downloading a new part of the sky. Those images also used to crash all the early GUI irc and chat clients that showed inline images without size checks...

How were you tracking each IP address's data usage? Did you parse the logs every request? Store usage in a database? At the application or webserver level?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#218

Post by raincole »

arbol wrote: post #197
Fokamul wrote: post #5

Please, anyone from EU (US is doomed rofl) create a petition to ban browser-fingerprinting in EU, across all existing browsers. I'm not good at creating petitions but can happily sign it. Also with stop killing games and anti-chat control. I can imagine this can get a traction, if it's explained in youtube video to "normal" people.

You literally can't get rid of it without introducing government issued ID to buy any scarce freely accessible items

Which is why it's very likely to happen, especially in the EU.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#219

Post by jorvi »

high_priest wrote: post #209
jorvi wrote: post #204

Earlier quoted context omitted.

Brave has aggressive fingerprinting protection, I have Auto-Shred (formerly Forgetful Browsing) turned on, I use VPN and yet I rarely get gated out.

A testament to how well Brave protects you from being identified by [Cloudflare in this example]

Not sure what you mean, Brave blows Firefox out of the water in terms of privacy protections. Firefox has milquetoast fingerprint protection and it doesn't even block ads. uBlock is worse than Brave's blocking by virtue of not being natively integrated.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#220

Post by p_l »

gruez wrote: post #157
binaryturtle wrote: post #141

Earlier quoted context omitted.

I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."

>I wonder if the website owners realise at all how many actual users they lose by this sort of "protection." How many people do you think are browsing with a weird enough config (eg. custom browser like OP, or some weird config like firefox with fingerprinting protection on a raspeberry pi) to trip cloudflare's protection?

Does not have to be weird, at least once it happened to me that their strictest settings simply banned something like major portion of internet users in my country - to the point that if you had FTTH you were likely blocked.

And no, it wasn't due to a country-based block selected by site operator.

Post reply on HN