Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

331–340 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#331

Post by arrty88 »

ethin wrote: post #164
jwr wrote: post #96

Earlier quoted context omitted.

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

I use CF and i don’t enable these anti bot measures. It’s up to the web master

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#332

Post by mattstir »

btown wrote: post #119
Hnrobert42 wrote: post #94

Earlier quoted context omitted.

Maybe, the proof of work can run in the background.

Or it can run as part of a checkout wizard's "verifying your browser and processing your payment, don't close your tab" step.

At which point it exists solely to punish real human users? What scraper bot is going through checkout?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#333

Post by danielheath »

userbinator wrote: post #305
danielheath wrote: post #291

Earlier quoted context omitted.

It's circumstantial evidence, but Occam's Razor also applies. It's not a hostile DOS in the traditional sense (I've mitigated a few of those) - no "pay us to make it stop", no pattern to the requests other than "fetch every unique URL a few times". It wasn't happening until financial incentives to gather large datasets for AI training appeared. Bad actors (using residential proxies & claiming to be a real browser) mo…

no "pay us to make it stop" "use Cloudflare to make it stop"

Or fastly, or akamai, or bunny, or any number of other providers.

Cloudflare are merely the cheapest of the bunch.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#334

Post by mattstir »

QuantumNomad_ wrote: post #89
timpera wrote: post #42

Earlier quoted context omitted.

Anubis often takes more than 60 seconds to complete on low-end devices (especially old smartphones). It seems like there's no good solution.

But after you’ve completed the Anubis PoW challenge for a site, it remains valid for some amount of time. So it’s not quite as horrible as it sounds. I have setting up Anubis for my own sites on my todo list. And I wish more people did it too. I don’t really mind waiting a little bit extra every now and then before the page loads. What I do mind is ReCaptcha asking me to click all the pictures with buses in them etc.…

> So it’s not quite as horrible as it sounds.

I don't know about you, but if a random webpage takes 60+ seconds to load, I just close it and choose to never interact with that site again (unless it's my bank, which is a real and annoying occurrence).

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#335

Post by LelouBil »

rfl890 wrote: post #275
WatchDog wrote: post #262

Earlier quoted context omitted.

By the same token, you aren't entitled to see the website content.

True, but that's at the discretion of the content author/publisher, not Cloudflare Turnstile.

It's the publisher that enabled Turnstile.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#338

Post by [deleted] »

aboardRat4 wrote: post #300
CrimsonRain wrote: post #160

Earlier quoted context omitted.

I'm one of those who have enabled cloudflare on all of the sites I maintain. Additionally, Added turnstile on every form. I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. Recently I also hard blocked all IPs from china Singapore India Pakistan Russia and whole of africa. Do I want to do it? No. But the amou…

[flagged]

[deleted]

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#339

Post by ai_fry_ur_brain »

Ive been concerned about Cloudflare turnstile fingerprinting ever since I started being forced to "prove I was human" on my anonymous X/Twitter accounts anytime I'd say something anti police/government/military.

I would get locked out of the account on all devices after saying these things until I compeleted their turnstile. For many accounts I just never used them again.

I could go more into this, but im highly suspicious of Cloudflare and of course X/Twitter in this regard. Ive been reccomend people to follow on anonymous twitter accounts for people I went to elementary school with and havent spoken to in years and have no digital connection to. Its very weird.

Post reply on HN