Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

231–240 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#231

Post by temp667 »

apple4ever wrote: post #134
WORMS_EAT_WORMS wrote: post #68

Earlier quoted context omitted.

Second this. For a major sporting event, one of our sites was heavily targeted by “free TV streaming services” self promoting their stuff. No amount of Google CAPTCHA or Cloudflare could stop it while keeping it online. Never seen anything like it in my life.

That makes me so frustrated. I HATE CAPTCHA's with a passion. They are everywhere and constantly slow me down. And you mentioned, they are likely not helpful in stopping bots.

I almost never see a captcha. On a static fiber IP - 1GB. Use chrome. Not sure if that matters.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#232

Post by kevincox »

djoldman wrote: post #217

It seems to me that forcing the user to go through captcha is a big negative user experience. Google must be docking points from websites that employ captcha then, right?

It doesn't matter. Googlebot is whitelisted.

(Partially sarcasm, I do know that Google does do some anti-cloaking crawling)

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#233

Post by kevincox »

osmarks wrote: post #206
ComodoHacker wrote: post #80

Is CAPTCHA a necessity only in ad-sponsored web? Is there other compelling use-case for it? Can we make CAPTCHA obsolete with decent micropayments solution, when you pay for every transaction with every website, just like we pay for every drop of water we use? Perhaps ISPs could handle it for us?

I can't see that being very popular. Even if it doesn't actually cost you much in absolute terms, billing per page will make people a lot more reluctant to explore new content.

This is an often neglected benefit of "Unlimited" plans. It changes the feeling of consuming. You have already paid so you may as well enjoy instead of asking "Do I really want to pay for this?" at every use.

From a technical point of view it is possible. Assuming that the payments were mediated by some party that party could issues statements like "this user has used their monthly allowance but they would pay". Assuming that this provider is widely trusted websites may treat this as a "real user" and allow the visit. (This is roughly how https://coil.com/ works.) Of course there are negative implications such as making it very difficult for new providers to get started.

You can also imagine some type of smart-contract where the subscription fee is split at the end of the day or month amongst the visited sites. Upon visit the sites just get a token for one share. Of course this would need to be very carefully designed to prevent abuse. (Example one malicious client splitting their subscription across millions of pages)

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#234

Post by dane-pgp »

md_ wrote: post #81
danShumway wrote: post #65

Complete aside, but I'm still not certain I understand the technical details of why Cloudflare can't uniquely identify users. I thought I knew how hardware keys worked, but apparently I don't. If the key being shared is embedded in the device, even in a secure enclave or something, then my understanding was that would open the door for key extraction. If the key is unique per-device, then that's not a problem. But if…

https://fidoalliance.org/fido-technotes-the-truth-about-atte... explains this pretty well. Basically: * Attestation keys are not unique per authenticator; they're shared among batches of authenticators. * If you extract the batch's attestation key, you can imitate authenticators from that batch. That doesn't mean you can authenticate as a registered authenticator, of course; it just means you can pretend to be a "Yub…

> they can always choose to distrust batches known to be compromised.

Which effectively means bricking the devices of 9999 innocent users each time.

Why are we creating a world where users will be told they can't visit a website or access their account any more because they didn't spend enough money on a hardware DRM device which tries to hide a key from them?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#235

Post by midev »

grishka wrote: post #204
fierro wrote: post #185

Earlier quoted context omitted.

what? Have you ever dealt with a DDoS attack and the consequences on your availability and infra health?

Are ddos attacks a common enough occurrence to warrant putting half the internet behind ddos protection? In my impression you need to do something really wrong to deserve one.

Yes, attacks on the web are very common for any decent sized site. Just because something is publicly available doesn't mean you get unfettered access to do whatever you want.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#236

Post by midev »

grishka wrote: post #132

Cloudflare captchas in particular, and any checks and roadblocks to see something publicly available in general, are terrible, period. It doesn't matter which form they take. Every time you see one you feel like a second-class citizen and get reminded that the internet is no longer what it used to be. I personally simply close the tab when I see a cloudflare "one more step" page.

This is completely wrong. Site administrators can put any controls they want in place to limit access. I don't know where you get the idea that things on the Internet need to be publicly available or without restriction.

Unless you're an original ARPANET contributor, there have always been attempts to control access and stop attacks. You're making the same mistake every conservative does. Longing for a nostalgia that never existed.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#237

Post by ehutch79 »

jjav wrote: post #214
ehutch79 wrote: post #151

Earlier quoted context omitted.

Monocultures are always bad, but I don't see any alternative services with this level of ease of use. You're definitely overestimating the technical expertise/available time of a lot small time admins out there. You don't see bots and spam on those forums either because they are actually using cloudflare, and you're just not seeing the captcha, or because in the backend they're feeding all their posts through akismet…

> My point in all this is that bitching that site is using cloudflare to not have to deal with crap, is a self centered view. Who is serving whom here? If a business thinks it's ok to impose cloudflare inconvenience on me, the customer, for the priviledge of giving them my money, who is self centered here? The simple answer is I'll close the tab and go buy it from a competitor. I'm not playing captcha games to buy so…

Why do I feel like you ask to speak to managers a lot?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#238

Post by midev »

jjav wrote: post #211
ehutch79 wrote: post #135

Earlier quoted context omitted.

How do you mitigate ddos attacks and other bad actors hitting a page? What does your cdn solution look like? Route optimization from your (single) endpoint to clients literally half a world away?

> How do you mitigate ddos attacks and other bad actors hitting a page? Not sure what "bad actors hitting a page" even means. I host public info so people can see it, be it good or "bad" people. Let them see it. DDoS is different and can be devastating of course. Also, very rare. In decades hosting content (started my first hosting business in 1994) I've never experienced anything remotely like a DDos. I know it happ…

> Not sure what "bad actors hitting a page" even means

I would refrain from commenting on this topic then.

> I host public info so people can see it, be it good or "bad" people. Let them see it.

If your site ever gets big enough, you'll understand.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#239

Post by [deleted] »

TimWolla wrote: post #216
ignoramous wrote: post #112

Earlier quoted context omitted.

> Each key is associated with a batch of devices, though. If you ban a key, you risk banning a bunch of legitimate users. You're right. I meant Cloudflare could ban the generated public-key and not the device's public-key itself. Besides, they could also mark the batch as being taken over by bots and increase the level on challenges issued to the batch. Note though, a single secure module can only generate / store so…

> For instance, Yubi Key 5 supports up to 25 keys This is for resident keys. A YubiKey 5 supports an infinite number of non-resident WebAuthn keys, because the returned key handle will simply be the private key encrypted with a master key stored on the YubiKey. For authentication the service will send the stored key handle back to the YubiKey which then can decrypt it and use the decrypted private key to sign the cha…

[deleted]

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#240

Post by eikenberry »

TimothyBJacobs wrote: post #205
anothergram wrote: post #160

Earlier quoted context omitted.

Alternatively, if services demand a fee then there is no need for human verification. Instead of trying to solve anonymous human verification we can as well make micro-payment an option.

A small micropayment makes for a great way for bad actors to test stolen credit card numbers.

You can't do micro payments with credit cards, they have to much $$ overhead. You'd need to pay into a service that'd handle the micro-payments and they'd have minimal packages to buy to mitigate these issues.
Post reply on HN