Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

381–390 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#381

Post by onel »

Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

Unfortunately, I think the solution will be invite only services, communities, etc. Someone needs to invite you to have access to it. If you host your own blog then that might be okay to have public access, you would want everyone and everything to read it. But if you're hosting your own photos, we might need tailscale like services to only allow certain people to access that.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#382

Post by arbol »

0123456789ABCDE wrote: post #210
arbol wrote: post #182

Earlier quoted context omitted.

PoW doesn't stop bots.. It's an annoyance at most. A rate limiter and nothing more

PoW difficulty can be scaled, eg: all cookies must work 1s, but 2nd cookie from the same ip, might have to do 2s of work ideally one would pick something a bit more forgiving than a linear function, to avoid penalizing too much users connecting from CGNAT

I think we're talking about 2 different things. PoW is annoying for basic scrapers but it really doesn't affect enterprise grade bot operations with access to unlimited residential proxies.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#383

Post by arbol »

AgentReinAi wrote: post #376

This is a concerning trend. Turnstile was marketed as a privacy-respecting CAPTCHA alternative, but requiring WebGL fingerprinting undermines that entirely. At this point what's the actual difference between this and the tracking they claimed to replace?

At the time, reCAPTCHA was the alternative and it was effectively working as a giant ad targeting data collection tool. I'm pretty sure Google have now back tracked from this.

WebGL finger printing is just one of many things you need to do if you actually want to stop automation. There is no way round it other than requiring ID of some sort.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#384

Post by account42 »

denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

> but unless you do PoW (which is also ecologically a nightmare), probably fingerprinting is the way to go

Only as long as legislation and law enforcement is off the table. Almost like we have those because everyone doing their own policing is not a reasonable way to run a society.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#385

Post by account42 »

aboardRat4 wrote: post #301
ranger_danger wrote: post #266

Earlier quoted context omitted.

> Cloudflare's scraping protection works about as well as a $5 padlock It sure seems to keep me, the casual visitor, far away from just about any site they "protect". I have zero desire to alter my browsing configuration or use extra tools to get around turnstile, I'd rather not even visit the site in the first place.

>, I'd rather not even visit the site in the first place Until your bank, airline, and tax ministry start using them.

Even more reason to boycott sites using it now.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#386

Post by account42 »

leonidasrup wrote: post #171
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

Fingerprinting for "bot protection" is indistinguishable from fingerprinting for mass surveillance.

And incentives mean those doing the former will also do the latter.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#387

Post by account42 »

ethin wrote: post #164
jwr wrote: post #96

Earlier quoted context omitted.

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system

So delegalize it. Strip searching everyone to paper over the fact that the societal contract has been broken only delays that.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#388

Post by account42 »

canyp wrote: post #215
jwr wrote: post #165

Earlier quoted context omitted.

> we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system No, we don't know. I honestly do not understand the problem. I run websites, both static and non-static. Granted, my sites aren't exactly the most popular internet go-to destinations, but I should be seeing this DDoS too, right? I do see lots of requests. Nothi…

I second this. My website exposes a cgit and 99% of the traffic now is AI scraping the sources, but the load is nowhere near DoS territory. And this is running on the cheapest VPS I could find. Not saying I'm not annoyed by the scraping; I am looking to block them, but I'm also not going to put the site behind the gatekeeper. If anything, Cloudflare must love AI scraping now for the same reason AV companies love malw…

The PHP stack isn't even the problem, it's having unauthenticated requests getting past the cache in the first place, something that most sites should be able to prevent.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#389

Post by [deleted] »

dcrazy wrote: post #317
zzo38computer wrote: post #297

Earlier quoted context omitted.

That is not a good excuse for requiring overly complicated and overly specific software.

Every HN thread is full of people who think webmasters should just pay through the nose to handle bot traffic to preserve the sacred rights of turbonerds to visit their website using Lynx on their toaster.

[deleted]

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#390

Post by brandonwindson »

CrimsonRain wrote: post #160
binaryturtle wrote: post #141

Earlier quoted context omitted.

I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."

I'm one of those who have enabled cloudflare on all of the sites I maintain. Additionally, Added turnstile on every form. I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. Recently I also hard blocked all IPs from china Singapore India Pakistan Russia and whole of africa. Do I want to do it? No. But the amou…

Yea, honest admins block entire regions because spam and bot traffic make it impossible to stay open
Post reply on HN