Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocked by Cloudflare

jrhawley.ca

Post reply on HN
Print view View original

351–360 of 473 posts

Re: Blocked by Cloudflare

#351

Post by Tozen »

The problem with Cloudflare is they purposely attempt to break user privacy by dangling websites as carrots. It's deception that they are attempting to determine if the person is human or not, because often they won't even show you the CAPTCHA. Even if you do get to the CAPTCHA, sucessfully doing it usually won't give you access to the website either. So, what is the point?

They want people to disable any privacy protections or push usage of browsers that have no to less privacy protections, in order to access the website they are blocking. This has nothing to do with if a user is an actual threat or bot, but is more a strategy to shape what browsers are used and destroy user privacy.

Cloudflare is also very aware of the numerous and constant complaints about what they are doing, coming from users and for years. They are ignored, because they have something else in mind.

Re: Blocked by Cloudflare

#352

Post by doctor_radium »

cutler wrote: post #217
lambda wrote: post #157

Earlier quoted context omitted.

And even when it doesn't block you completely, it delays website loading, makes you jump through frustrating captchas, etc. It's probably third in the list of frustrating web behaviors in the past couple of years (behind GDPR popups and registration/paywalls that seem to have gotten much worse recently). And somehow there are some sites that I get CF delay walls on every time I visit. This feature is utterly broken f…

Why not take a screenshot of the CF error and send it to the website owner? It would freak me out if I thought a significant number of my website's users were being blocked by CF.

+1 to anybody who creates a site to name and shame CF customers who block legitimate traffic. For a few months now I've been taking screenshots every time this happens, but with no end goal. Complaining to the individual site owners feels like a lifetime commitment, and there are virtually none I need that badly.

Re: Blocked by Cloudflare

#353

Post by petre »

danShumway wrote: post #349
petre wrote: post #343

Earlier quoted context omitted.

So cancel your credit card with them? They have a reason field on the cancellation form.

If my own bank/credit card blocked Firefox I would cancel with them. I'm pointing out that this isn't really normal or justifiable. To your specific point about just moving elsewhere, complaining in public about bad industry practices is part of Capitalism and part of how consumers regulate the free market. "Take your business elsewhere instead of complaining" has never really been how this has worked; businesses don…

> I'm pointing out that this isn't really normal or justifiable.

Oh well, what can you do? Vote with your wallet. Tell everyone on HN and Reddit. I agree. But at a certain point it wastes too much of my energy, so I'll basically just cancel cand tell them I can not use their service because reasons, very disappointed, bye.

Re: Blocked by Cloudflare

#354

Post by 22c »

waithuh wrote: post #279
adammartinetti wrote: post #231

Earlier quoted context omitted.

Would you be able to send me a rayID of a failed challenge so I can take a loop? It sounds like you can use https://gitlab.com/users/sign_in to generate one. You can either reply in the comments with the ID (no PII), or email me at amartinetti at cloudflare.com and I'd love to dig into it. We're building Turnstile because we want to make challenges a better system than CAPTCHA. It sounds like for you it's worse, and…

7f3bfdf6bee5b9ea here is one. I'm not on my PC so i used a privacy enchanted fork of Mobile Chrome. Enabled WebGL, WebRTC and WASM. Disabled all the fingerprint resistant features i could easily (the only thing messing with your systems could be the HTTP Referrer or Timezone) Perhaps its a DNS-level issue? Does cloudflare use any google related APIs to provide the integrity check?

> Perhaps its a DNS-level issue?

I run dnscrypt-proxy and I have seen CloudFlare protected sites reject me based on that. I haven't been able to pinpoint which upstream resolver provider causes it as I have it set to automatically cycle through and it's intermittent enough that I haven't bothered getting to the bottom of it (ie. doesn't happen for several weeks and then happens for 15 minutes or so before resolving).

Perhaps it's one of the default DOH providers being used by Firefox?

https://wiki.mozilla.org/Security/DOH-resolver-policy#Confor...

Presumably not CloudFlare themselves, though.

I'm not a Chrome user, but does Chrome automatically use Google DNS these days?

Re: Blocked by Cloudflare

#355

Post by sammy2255 »

krono wrote: post #80

The amount of times Cloudflare is making me sit through their 15 to 30 second "checking your connection" page is insane. For people going through life with ADHD such as myself, the impact of all these delays and disruptions throughout the day can be severe. Despite being properly medicated this measure is absolutely debilitating and makes for a dreadful and very taxing online experience.

Cloudflare isnt making you do that. The customer using Cloudflare has configured it to do that…

Re: Blocked by Cloudflare

#356

Post by [deleted] »

adammartinetti wrote: post #231
waithuh wrote: post #208

Earlier quoted context omitted.

I dont know which type of Firefox you use, but any reasonably tuned browser (in the privacy sense) fails your systems. I literally didnt have a single instance of passing them without handing over a pixel perfect fingerprint.

Would you be able to send me a rayID of a failed challenge so I can take a loop? It sounds like you can use https://gitlab.com/users/sign_in to generate one. You can either reply in the comments with the ID (no PII), or email me at amartinetti at cloudflare.com and I'd love to dig into it. We're building Turnstile because we want to make challenges a better system than CAPTCHA. It sounds like for you it's worse, and…

[deleted]

Re: Blocked by Cloudflare

#357

Post by goodpoint »

adammartinetti wrote: post #76

Hi there, I'm the PM for Cloudflare's challenge platform. I'd love to look into what the cause of the problem is, so you don't see these difficulties. > Cloudflare detected the high frequency of requests and denials (but not their faulty loop that caused this pattern of requests, of course), and tagged my browser as suspicious. I can tell you at least that we don't penalize users for this looping behavior, so this wo…

> I'd love to look into what the cause of the problem is

No, you don't. Tor Browser is constantly blocked by Cloudflare and the captchas cannot be solved. And you know it.

Re: Blocked by Cloudflare

#358

Post by goodpoint »

jeroenhd wrote: post #114
krono wrote: post #80

The amount of times Cloudflare is making me sit through their 15 to 30 second "checking your connection" page is insane. For people going through life with ADHD such as myself, the impact of all these delays and disruptions throughout the day can be severe. Despite being properly medicated this measure is absolutely debilitating and makes for a dreadful and very taxing online experience.

Cloudflare's Privacy Pass may help here: https://privacypass.github.io/ It should significantly reduce the amount of CAPTCHAs you see in a way that's not terrible for privacy. For Safari, you can enable Private Access Tokens: https://blog.cloudflare.com/how-to-enable-private-access-tok... Both of these mechanisms are similar to Google's web DRM proposal in that they rely on external issuers to generate tokens, but un…

This should be illegal.

Re: Blocked by Cloudflare

#359

Post by youngtaff »

dcow wrote: post #274
smolder wrote: post #267

Earlier quoted context omitted.

No, the idea is they're abusing existing APIs for fingerprinting purposes that Firefox privacy settings disallow --canvas font rendering difference detection, detecting your GPU model, and things of that nature. But this new API demonstrates that Google is not on the consumers side when it comes to limiting tracking/data gathering ability, as the new API is explicitly for fingerprinting.

I thought it was the opposite: that instead of fingerprinting users, web services would instead just ask the browser which topics the user is interested in and display the relevant ADs. It's an explicit design goal to reduce the dependence on fingerprinting users, otherwise why would they do it. Topics are supposed to be the locally sourced privacy preserving alternative to invasive tracking. Whether Mozilla/Apple/ot…

For me the issue is a browser shouldn’t be making the information on the topics of sites I visit available to anyone who asks

Re: Blocked by Cloudflare

#360

Post by wrkta »

shadowgovt wrote: post #270
amatecha wrote: post #161

Earlier quoted context omitted.

On that note... https://www.folklore.org/StoryView.py?project=Macintosh&stor... "Well, let's say you can shave 10 seconds off of the boot time. Multiply that by five million users and thats 50 million seconds, every single day. Over a year, that's probably dozens of lifetimes. So if you make it boot ten seconds faster, you've saved a dozen lives. That's really worth it, don't you think?" Imagine if people still thoug…

ReCAPTCHA was designed with this in mind: given that we had the need to distinguish humans from bots, it presents problems that are hard for bots to solve, where the resulting output is valuable. So the time consumed isn't wasted.

It's wasted from the perspective of the end user.
Post reply on HN