Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

251–260 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#251

Post by simfree »

withinboredom wrote: post #244
ehutch79 wrote: post #187

Earlier quoted context omitted.

Apologies, your username looks like the one that tossed that number out as a what they assumed was a high number. 200ms latency isn't that bad, but I'm seeing more 800-2000ms latencies with some users depending on physical location. at some point latency kills usability. Especially when trying to get through a complicated QA or inventory process.

That latency is literally impossible unless they’re up in space somewhere, beyond satellite orbit. Your latency is most likely caused by CPU on low-end devices. A CDN won’t help you with that (and probably be harmful having to manage another TCP connection).

I see latency spike like this often on T-Mobile LTE. One second your under 40ms ping, then your next ping clocks in at 794ms or 2100ms despite having good signal strength.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#252

Post by est31 »

wbkang wrote: post #54
lsaferite wrote: post #15

Privacy seems like a bad argument considering CF already has the technical ability to easily track you across all of the sites they front if they so desire.

With each domain u2f generates a different key (conceptually) so this should be harder to track potentiality.

The attestation key is the same for each website the device logs in to.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#253

Post by the_pwner224 »

temp667 wrote: post #231
apple4ever wrote: post #134

Earlier quoted context omitted.

That makes me so frustrated. I HATE CAPTCHA's with a passion. They are everywhere and constantly slow me down. And you mentioned, they are likely not helpful in stopping bots.

I almost never see a captcha. On a static fiber IP - 1GB. Use chrome. Not sure if that matters.

> Use chrome.

That's why. Try using Firefox without being logged in to Google and with an ad blocker - you really won't like it.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#254

Post by jlokier »

ehutch79 wrote: post #224
jlokier wrote: post #201

Earlier quoted context omitted.

You can conduct fraud by accessing public, read-only web pages? You can conduct fraud by searching on Google? Those are the two I find repeatedly blocked when accessing via Tor. The former by Cloudflare, the latter by Google. I use Tor to lookup phone numbers that have just called me, to decide whether it's a good idea to answer. Since I don't want to be personally associated with such numbers I prefer to search anon…

Then don't use sites that are behind cloudflare? It's not your choice if the site owners/admins use cloudflare. It IS your choice not to use those sites.

In practice the information I'm looking for is behind Cloudfare. There are other sites; they tend to lack the information.

There is no "don't use" if I want to get my task done.

I can choose not to obtain the information, but then I still have the problem I started with.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#255

Post by nijave »

grishka wrote: post #249
tick_tock_tick wrote: post #222

Earlier quoted context omitted.

Yes, they absolutely are. Hell just getting a few random bots scraping stuck in a loop or being overly aggressive on your site is enough to double your bill. So yeah it's 100% required.

> to double your bill Do you pay a variable amount for your hosting? How and why? All VDS and dedicated server offerings I've ever seen are fixed amount per month. And more often than not the network is limited by speed, not by data transfer.

When you get DoSd you either pay to absorb the traffic or go down. Usually paying a DDoS service is the cheapest option but if you're not, you're paying for more infrastructure (or going down)

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#256

Post by nijave »

withinboredom wrote: post #244
ehutch79 wrote: post #187

Earlier quoted context omitted.

Apologies, your username looks like the one that tossed that number out as a what they assumed was a high number. 200ms latency isn't that bad, but I'm seeing more 800-2000ms latencies with some users depending on physical location. at some point latency kills usability. Especially when trying to get through a complicated QA or inventory process.

That latency is literally impossible unless they’re up in space somewhere, beyond satellite orbit. Your latency is most likely caused by CPU on low-end devices. A CDN won’t help you with that (and probably be harmful having to manage another TCP connection).

I few years back I was seeing about 15-30s latency on 2G EDGE. Overloaded links can have high latency due to queuing which CDNs tend to help

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#257

Post by nijave »

grishka wrote: post #178
aseipp wrote: post #169

Earlier quoted context omitted.

> Yes, there will be 200 ms RTT in some cases. So what? Get over it. You're missing a zero in that RTT for users in places like Asia if your server is anywhere in the west. (It's actually somewhat revealing when someone throws out a number like this without any qualification; what exactly made you conclude 200ms is the magic number?) > Optimize your website to load in fewer round-trips. TCP congestion control adapts…

> You're missing a zero in that RTT for users in places like Asia if your server is anywhere in the west. Well, it does say 130 ms in here: https://www.quora.com/How-long-would-it-take-for-light-to-fl... And that's around the planet, to go around and end up at the same spot. In practice, with sanely-configured routes, your packets should never need to traverse more than half that distance. So, divide it by 2, then th…

Most end users are not in a position to control the path their packets take. Their ISP could route their packets around the world 6 times over if they can save a nickel doing it

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#258

Post by poisonborz »

AtNightWeCode wrote: post #225
poisonborz wrote: post #215

Earlier quoted context omitted.

Ah yeah, instantly zeroing anonimity for most users, while it can be still abused by malicious actors, a great worst of both worlds solution.

Not sure how you came to that conclusion from what I said. What I am saying is that in the long run it will be impossible to rely on companies like Cloudflare for security when it comes to users. Over time all services will for security reasons need to either directly or indirectly authenticate all their users. That does not mean that each users identity is provided to each consumer. The open Internet is already dead…

It just alluded to an internet strictly divided between "verified" single users (persons, regardless if per service) and everyone else (assumed as malicious by default) as a total and unavoidable path.

I think the nature of the internet necessitates temporary, limited gatekeepers like CloudFlare, but as long as the legal status and technology keeps maintaining moving targets (like how you can fake your way out with a dedicated ip vpn, or just remain within tor network) this isn't too much of an issue. Anonimity+trust will never be a fully solved problem, and as long as a comfortable level is achievable between willing parties, the status quo remains.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#259

Post by SquareWheel »

djoldman wrote: post #217

It seems to me that forcing the user to go through captcha is a big negative user experience. Google must be docking points from websites that employ captcha then, right?

It requires loading a JS library and that does dock them points for performance. So yes sites are penalized for it.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#260

Post by tialaramex »

userbinator wrote: post #248
tialaramex wrote: post #117

Earlier quoted context omitted.

Their document says, correctly, that the means by which they could try to do this would be to shove the arbitrary random ID they get into a cookie. You may have noticed that both Facebook and Google already use cookies. Did you know Hacker News has a cookie too?

Did you know Hacker News has a cookie too? There's a difference between being logged in to an account on a single site, and letting Big Tech track you across most of the Internet.

WebAuthn isn't "letting Big Tech track you" which is why, as Cloudflare explains, they would need to store the ID in a cookie to remember what it is.

You might be thinking "Duh, they can ask the Security Key". Nope, the Security Key hasn't the faintest idea, remembering that ID is the Relying Party's job, the Security Key isn't going to remember.

Post reply on HN