This is an issue I am running up against on Safari (Version 26.5 (21624.2.5.11.4)) on MacOS 26.5.
I keep getting the turnstile and having to click the "I a human" button.
Cloudflare Turnstile requiring fingerprintable WebGL
261–270 of 508 posts
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#262>It looks like you're trying to hide your identity. You were never entitled to it in the first place
By the same token, you aren't entitled to see the website content.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#263Earlier quoted context omitted.
The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…
> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…
If you're in any way semi-popular and a decent size, you're gonna get hammered. PortableApps.com was partially offline for weeks due to China-based AI scrapers. You block the useragent, they start hitting you with another one from the same IP in the same way. You block the IP, they switch to another. You block the subnet, they use another. At one point it was nearly a thousand different IPs from around China hammering away. For all intents and purposes, a DDoS. This wasn't a little "extra load", this was load that was thousands of times beyond what our legitimate userbase was using.
And if you're thinking about blocking all of China, while this particular AI bot didn't use them, a bunch of other ones I've encountered use VPNs and hacked clients worldwide.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#264...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!
web environment integrity
But that is so clearly worse than WebGL fingerprinting!
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#265Earlier quoted context omitted.
I used to just start giving any IP downloading way too much a redirect to multi-tb NASA images. This was a long time ago but it was surprisingly how many would follow redirects and never time out. Wouldn't see a request again for hours and then its right back to downloading a new part of the sky. Those images also used to crash all the early GUI irc and chat clients that showed inline images without size checks...
How were you tracking each IP address's data usage? Did you parse the logs every request? Store usage in a database? At the application or webserver level?
Webalayzer! I'm not sure there were really any other options at the time other than writing your own. Parsed the apache logs and gave you pretty detailed results and you could see the usage (in kb, which tells you how long ago this was!) broken down by date and IP.
Once you added a redirect rule for the IP to apache you'd just check your log and see the IP that was hitting you every couple of minutes poofed for a good few hours.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#266Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…
it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.
> Cloudflare's scraping protection works about as well as a $5 padlock
It sure seems to keep me, the casual visitor, far away from just about any site they "protect". I have zero desire to alter my browsing configuration or use extra tools to get around turnstile, I'd rather not even visit the site in the first place.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#267Earlier quoted context omitted.
You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles. Firefox with a non-default profile can be created like that: ./firefox -CreateProfile "profile-name /home/user/.mozilla/firefox/profile-dir/" # For, say, cloudflare that would be: ./firefox -CreateProfile "cloudflare /home/user/.mozilla/firefox/cloudflare/" An…
Except that fingerprinting means that both profiles are actually tied together by cloudflare (and other tech companies)
that's why I use completely different browsers with different settings. my CF-friendly one (not my daily driver) is `firejail --private chromium` so it always starts with a clean temporary profile
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#268Earlier quoted context omitted.
> just ask anyone who runs a more popular site The person you're responding to already said they ran a modestly sized site. What actual scale opens one up to abuse? If only the top 1% of sites need it, then it seems silly to say "everyone" needs it.
It’s not just scale. Do you accept user generated content? If so, more of a target.
Stack Overflow was outside of the Cloudflare network for years, and anti-abuse was maybe 3 or 4 full-time jobs – much of which still needs to be done, because Cloudflare's anti-bot protection hasn't actually stopped it. Most UGC sites are not as big as Stack Overflow was at its peak.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#269Doesn't this mean we just need to make the webgl fingerprint resistance implementation smarter? Instead of explicitly rejecting webgl access or responding with dummy data, respond with data that is random within space of N common and reproducible patterns. E.g. emulate webgl implementation of some low spec but actually popular devices.
The last screenshot in the OP article mentions that "a browser extension... adding random noise to canvas data" can be detected. Which isn't to say this perfectly detects all such randomization, but it's certainly an active part of the arms race.
Yes but the idea is that the protection should be part of the browser itself, then it becomes the expected norm AND isn't really "detectable" since there's no extension to redefine javascript variables. Scraper-friendly solutions like Camoufox or CloakBrowser make such changes to avoid having the same fingerprint every time while still appearing normal.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#270Earlier quoted context omitted.
The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…
> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…
> I understand there are sites for whom this causes problems, but I think these are rare and could be optimized not to do unreasonable things.
There are. They're not. They can't (without significant effort)