Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

251–260 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#251

Post by segmondy »

jwr wrote: post #96
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

I use a cellphone internet provider, there have been many a sites I couldn't access because or cloudflare or stupid recaptcha. i know damn well what a bicycle, bus, traffic light or stairs is.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#252

Post by daishi55 »

handoflixue wrote: post #231
acdha wrote: post #221

Earlier quoted context omitted.

We do know, just ask anyone who runs a more popular site or does anything where abuse can be monetized (shopping, reviews, etc.). Avoiding that due to obscurity isn’t an answer because it’s saying you’re safe until something, possibly outside of your control, causes the bots to descend and give you an extra 500M requests with no chance of revenue. I’m with OP: I don’t like this but the alternatives all look like the…

> just ask anyone who runs a more popular site The person you're responding to already said they ran a modestly sized site. What actual scale opens one up to abuse? If only the top 1% of sites need it, then it seems silly to say "everyone" needs it.

So everyone is paying cloudflare… why?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#253

Post by Wowfunhappy »

arbol wrote: post #192
Wowfunhappy wrote: post #17

Earlier quoted context omitted.

Let's say I'm selling concert tickets. How do I prevent bots from buying up all the tickets and scalping them?

- behavioural fingerprinting - ja4 - IP rep - queue mechanism - card country to IP country checks - app attestation - custom metrics based on knowledge of past scalpers It's hard but it's not impossible. You can make it very inconvenient for scalpers. They need to poll at volume so their behaviour is very much detectable. A hard stance is required on IP rep, especially for more in demand concerts.

I don't now, a lot of this seems just as invasive as WebGL fingerprinting, if not more invasive.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#254

Post by mcosta »

TkTech wrote: post #201
0x59 wrote: post #195

Earlier quoted context omitted.

Idk, if bots ate hammering your server then setup rate limits. If you have content that you don't want others to have access to, don't serve it with a webserver.

I used to just start giving any IP downloading way too much a redirect to multi-tb NASA images. This was a long time ago but it was surprisingly how many would follow redirects and never time out. Wouldn't see a request again for hours and then its right back to downloading a new part of the sky. Those images also used to crash all the early GUI irc and chat clients that showed inline images without size checks...

How do you know it followed the redirect and downloaded the image?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#255

Post by ceejayoz »

handoflixue wrote: post #231
acdha wrote: post #221

Earlier quoted context omitted.

We do know, just ask anyone who runs a more popular site or does anything where abuse can be monetized (shopping, reviews, etc.). Avoiding that due to obscurity isn’t an answer because it’s saying you’re safe until something, possibly outside of your control, causes the bots to descend and give you an extra 500M requests with no chance of revenue. I’m with OP: I don’t like this but the alternatives all look like the…

> just ask anyone who runs a more popular site The person you're responding to already said they ran a modestly sized site. What actual scale opens one up to abuse? If only the top 1% of sites need it, then it seems silly to say "everyone" needs it.

It’s not just scale. Do you accept user generated content? If so, more of a target.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#256

Post by fragmede »

daishi55 wrote: post #252
handoflixue wrote: post #231

Earlier quoted context omitted.

> just ask anyone who runs a more popular site The person you're responding to already said they ran a modestly sized site. What actual scale opens one up to abuse? If only the top 1% of sites need it, then it seems silly to say "everyone" needs it.

So everyone is paying cloudflare… why?

Most likely not. Their free tier is fairly generous.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#257

Post by nulledy »

nlitened wrote: post #167
nulledy wrote: post #84

Earlier quoted context omitted.

Bot rejection for contact forms. Better UX than reCaptcha.

Did you think it rejects bots by using some kind of magic?

Well, of course not, don't be silly. But if it blocks visitors of our site from using non-standard browsers, perhaps its worth exploring alternatives.

Nearly all of our sites are visiting by extremely tech literate folks, the exact type that may not be using Google Chrome or Firefox.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#258

Post by redox99 »

CodeBytes wrote: post #226
redox99 wrote: post #176

Earlier quoted context omitted.

You get downvoted for these opinions but I agree. Most people that complain that their servers get hammered by AI bots are those that run very unoptimized servers that can only handle like 100 rps. I've never had any issues with any of my moderately optimized websites. A $10 VPS can handle sooo much traffic.

I think people get annoyed when it's suggested they spend time optimising or even re-writing their websites to handle high traffic loads just to cater to AI bots ripping their content. It's also not always easy to do. I run a small wiki which is fairly optimised, nearly every page manages at least ~3k rps on a small VPS. The only exception is the diff page which is ~150 rps. Optimising that while still giving good ou…

What I do is have more strict rate limits for non logged in users. You tell them to log in if they hit the rate limit. For non logged in users, you have a rate limit not just for IP, but also for /24 and /16. Forget about IPv6, IPv4 scarcity is a feature not a bug.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#259

Post by redox99 »

ethin wrote: post #246
redox99 wrote: post #179

Earlier quoted context omitted.

As soon as you get your TLS certificate you get bombarded with scraping. You don't need someone to "point a scraper at you". What matters most is usually how much there is to scrape. If you have like 5 pages that's nothing. For forum like websites where each thread, each user profile, etc. gets scraped that's when traffic increases. I just let them have at it with no issues though, computers are fast.

That's really weird. My experience is quite different: I have several subdomains and all of them have TLS certs and I haven't (yet) seen this (thankfully). Either that, or my server is masking it. The weird thing is that my server is an OVH dedicated box that doesn't exactly have top-tier specs, so I have no idea what's going on there. Very weird indeed.

Probably you don't have much to scrape?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#260

Post by redox99 »

dr_um wrote: post #196
jwr wrote: post #165

Earlier quoted context omitted.

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…

A small, single EU country focused non-static e-commerce, with proper robots.txt instructions that worked perfectly well in the search & co bots -only "era" with rate limiting for nginx/php-fpm setup - is kinda struggling without CF to handle 15000 requests per 15 minutes, coming from Chrome "users" from IPv6. Best so far was an avg. server load in htop = 40 on an 8-core server x_x

That's 16.6rps. A single guy holding the F5 key on chrome can generate that much traffic and take down your website. That kind of performance was never acceptable.
Post reply on HN