Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

351–360 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#351

Post by mornanding »

leonidasrup wrote: post #171
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

Fingerprinting for "bot protection" is indistinguishable from fingerprinting for mass surveillance.

Talking about mass surveillance: After taking the usual measurements against cross-site browser tracking- who knows most about my website visits? Meta, Google or Cloudflare? Blocking me from site visits with fingerprinting shut off, forces all my traffic back into the CF funnel. Number of websites soaring. Try it yourself https://sereneblue.github.io/chameleon https://github.com/kkapsner/CanvasBlocker/ and you're increasingly off.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#353

Post by TurdF3rguson »

fsckboy wrote: post #232
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

> probably fingerprinting is the way to go - completely destroying the privacy of everyone involved your doctor seeing you naked does not destroy your privacy, it's your doctor sharing the photos with everybody that does. i.e. it problem here is that intermediaries like cloudflare don't work for you, they work for somebody else or sell the data themselves.

Wait, is your doctor taking photos of you naked?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#354

Post by defrost »

TurdF3rguson wrote: post #353
fsckboy wrote: post #232

Earlier quoted context omitted.

> probably fingerprinting is the way to go - completely destroying the privacy of everyone involved your doctor seeing you naked does not destroy your privacy, it's your doctor sharing the photos with everybody that does. i.e. it problem here is that intermediaries like cloudflare don't work for you, they work for somebody else or sell the data themselves.

Wait, is your doctor taking photos of you naked?

Molescan doctors do - they map the skin, log it, and look for changes over time.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#355

Post by novok »

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

Micropayments would be another one, but then governments and banks have to give up ~~financial control & surveillance~~ AML essentially to make it financially viable. AML also has a horrible track record of how much money is spent compared to the amount recovered.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#357

Post by actionfromafar »

novok wrote: post #355
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

Micropayments would be another one, but then governments and banks have to give up ~~financial control & surveillance~~ AML essentially to make it financially viable. AML also has a horrible track record of how much money is spent compared to the amount recovered.

Wouldn't micropayments be aggregated into a money laundering operation by some third party? (Wasn't IIRC even Spotify used for that?) Or would Cloudflare take all the money in this hypothetical scenario?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#358

Post by dotancohen »

TkTech wrote: post #265
dotancohen wrote: post #217

Earlier quoted context omitted.

How were you tracking each IP address's data usage? Did you parse the logs every request? Store usage in a database? At the application or webserver level?

Webalayzer! I'm not sure there were really any other options at the time other than writing your own. Parsed the apache logs and gave you pretty detailed results and you could see the usage (in kb, which tells you how long ago this was!) broken down by date and IP. Once you added a redirect rule for the IP to apache you'd just check your log and see the IP that was hitting you every couple of minutes poofed for a goo…

Now that's a name I've not heard in a long time.

That's nuts. I suppose you had Webalayzer on a minutely cron job. It might have been drawing more resources than Apache itself!

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#359

Post by thisislife2 »

ndriscoll wrote: post #58
thisislife2 wrote: post #36

Earlier quoted context omitted.

True. But it still wastes your server resources, right? And it's sad that you have to accept that as part of the "cost" of hosting a site ...

What resources are you concerned about? An n100 minipc should be capable of serving something like a blog at 20k+ requests/second (or saturating its network).

Sure. But 25,000 (bot hits / day) x 50kB (static webpage) = 1.25 GB / day / page x 30 (days) = 37.5 GB of data transfer / month / page. And that's assuming a static resource - if any of the resource is dynamically generated by the server, there's a CPU and memory cost too. Overall, even if you treat the impact on the server as "negligible", it's still an unnecessary waste of resource was the point I was trying to convey.

Here's a more real-world projection of the cost and server impact - The Bandwidth Cost of AI Crawlers: What Scraping Really Costs Publishers - https://aipaypercrawl.com/articles/ai-crawler-bandwidth-cost

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#360

Post by raxxorraxor »

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

I would like my browser to not pass their challenge and then flush support of services I cannot reach. This is the only way for them to stop, to really get on the nerves of their customers.

Those might ignore it, but there are always alternatives.

Post reply on HN