Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

461–470 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#461

Post by tomrittervg »

The Bugzilla bug is at https://bugzilla.mozilla.org/show_bug.cgi?id=2036440

The breadth of responses here about people who can't reproduce this (or can) is one of the most frustrating things about working on fingerprinting protection. I also cannot reproduce this behavior, and have to assume that there is some complicated, behind-the-scenes risk assessment that is being done and some people trigger it and some don't. If any Cloudflare devs want to chat, I would love to. While not a normal way to contact us (support requests will be ignored), I can be reached at security@mozilla.com

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#462

Post by jeroenhd »

petterroea wrote: post #336

"Your browser appears suspicious because it looks like you are trying to hide your identity" Another case of the much predicted downfall of freedom due to "people who hide themselves must have something to hide, so they are automatically suspicious"

This has nothing to do with identity and everything with bots and scrapers. Nobody but a handful of advertisers cares about the actual fingerprint of your browser, all they care about is letting through people and rejecting bots.

If tech companies weren't waging a war against public resources in an attempt to get their grubby little hands on every bit of data they can, we wouldn't be in this mess.

If there were a more reliable "I'm not a bot" signal and maybe some reliable method of rate limiting, we could do away with Turnstile and just let people through again. Unfortunately, every well-intended privacy measure is abused by AI's war against the public good.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#463

Post by jeroenhd »

cdolan wrote: post #447

The battle against the bots is becoming tiring. Stop trying to be a middleman broker of the entire Web, CF

Blocking bots is how Cloudflare makes money. There are cheaper CDNs out there but Cloudflare doesn't waste as much of your paid CDN bandwidth on bots.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#464

Post by LgWoodenBadger »

daishi55 wrote: post #252
handoflixue wrote: post #231

Earlier quoted context omitted.

> just ask anyone who runs a more popular site The person you're responding to already said they ran a modestly sized site. What actual scale opens one up to abuse? If only the top 1% of sites need it, then it seems silly to say "everyone" needs it.

So everyone is paying cloudflare… why?

Because charging for bandwidth/traffic is still a thing, unfortunately

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#465

Post by 0123456789ABCDE »

arbol wrote: post #382
0123456789ABCDE wrote: post #210

Earlier quoted context omitted.

PoW difficulty can be scaled, eg: all cookies must work 1s, but 2nd cookie from the same ip, might have to do 2s of work ideally one would pick something a bit more forgiving than a linear function, to avoid penalizing too much users connecting from CGNAT

I think we're talking about 2 different things. PoW is annoying for basic scrapers but it really doesn't affect enterprise grade bot operations with access to unlimited residential proxies.

look, if you have the kind of bank to pay $1/GB of web pages to get to whatever we're hosting, maybe just send an email to sales so we can give you discount on that.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#466

Post by redox99 »

tardedmeme wrote: post #394
redox99 wrote: post #365

Earlier quoted context omitted.

You were getting 1k rps, and each request was from an unique IP? So after an hour you got hit by 3.6M different IPs? And all from uncorrelated /16s? That seems hard to believe. Not that I don't believe you, it's just hard for me to grasp that whoever was scraping you had such a large and distributed swarm.

This is called rotating residential proxy service. You can buy it off grey market sites that are probably getting it from botnet operators. It costs about $2-$5 per GB.

Interesting, that definitely seems to be it.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#467

Post by BenjiWiebe »

mattstir wrote: post #332
btown wrote: post #119

Earlier quoted context omitted.

Or it can run as part of a checkout wizard's "verifying your browser and processing your payment, don't close your tab" step.

At which point it exists solely to punish real human users? What scraper bot is going through checkout?

The credit card tester bots go through the checkout process.

PoW wouldn't be a big issue for them though since their volume is much lower.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#468

Post by tomrittervg »

tomrittervg wrote: post #461

The Bugzilla bug is at https://bugzilla.mozilla.org/show_bug.cgi?id=2036440 The breadth of responses here about people who can't reproduce this (or can) is one of the most frustrating things about working on fingerprinting protection. I also cannot reproduce this behavior, and have to assume that there is some complicated, behind-the-scenes risk assessment that is being done and some people trigger it and some don't.…

And to the point about Mozilla's protections lacking, I've corrected the record: https://ritter.vg/blog-webgl_renderer.html

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#469

Post by dcrazy »

novok wrote: post #355
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

Micropayments would be another one, but then governments and banks have to give up ~~financial control & surveillance~~ AML essentially to make it financially viable. AML also has a horrible track record of how much money is spent compared to the amount recovered.

Anti-money laundering laws are a deterrent. If you know moving around $10,000 will be reported to FinCEN, as will any discovered pattern of structuring transactions below $10,000, then you are forced to pursue riskier ways of moving your money than Western Union.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#470

Post by krick »

brookst wrote: post #430
leonidasrup wrote: post #171

Earlier quoted context omitted.

Fingerprinting for "bot protection" is indistinguishable from fingerprinting for mass surveillance.

Sure, this is the age-old “knife used to cut steak is indistinguishable from knife used to stab people” thing. Tools are inherently amoral; only people can have motives we can celebrate or condemn.

I guess then you wouldn't mind if I cut you in order to verify you indeed aren't a steak, would you?
Post reply on HN