Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

481–490 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#481

Post by HappMacDonald »

thisislife2 wrote: post #46
ImPostingOnHN wrote: post #40

Earlier quoted context omitted.

I don't think regulation will stop web scraping, not least of which because it can be done from locations outside the jurisdiction of the regulations. > we have to acknowledge the system is broken The system is broken. It probably takes, what, 10 seconds or less to use a residential or foreign proxy, 6+ months to internationally track and prosecute a single offender? So like a million times more effort going the regu…

Just as criminal laws don't end all crimes, copyright laws and anti-scraping regulation won't end all scraping. But it will greatly reduce it and limit it to rogue actors. Two examples I can cite here are the laws against email spams and laws against unsolicited marketing calls - they had a definite impact in reducing both (even in India, from where I am, where implementation of laws are often lax).

One thing I want to know is how porn spam (that is, spam containing pornographic image attachments) vanished so suddenly in the early 2000s. It used to be a huge segment of spam, and then one day it all just vanished.

So.. what made it go away, and how could learning about that help us make all the rest of it go away too?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#482

Post by HappMacDonald »

mschuster91 wrote: post #166
thisislife2 wrote: post #33

Earlier quoted context omitted.

The only solution is regulation . If all content created by anyone has a copyright, how does an implicit opt-in (which is what happens if you don't create a robots.txt file for your website) for scraping make any sense? Moreover, even if you have a robots.txt, AI (or whatever) bots often don't respect it (or use workarounds - they outsource scraping of such "restricted" sites to unethical third-parties to get the dat…

> The only solution is regulation. The thing why Cloudflare got invented isn't AI scrapers. These are just the latest development... the original reason why Cloudflare got created and why it experienced such a meteoric growth is DDoS and botnets. Yes. We need regulation in the AI space. But it will be useless as long as bad actors aren't held accountable - and a lot of the bad actors aren't in our jurisdictions. You…

I just wish that DDoS wasn't such a huge racketeering game.

Who profits the most from it?

The services charging you to defend against it, that's who.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#483

Post by HappMacDonald »

ravenstine wrote: post #115
Wowfunhappy wrote: post #9

...in the age of AI, does anyone have an actual solution for keeping out bots while preserving the privacy of humans? Obviously this is terrible, but I think there's a possibility it's the least terrible option? Another option is IP reputation, which I think is worse. Or scanning a code with a non-rooted phone, which I think is even worse than that!

Or maybe we can actually start paying for all the things we use on the Web, making it prohibitively expensive to deploy fleets of bots.

Feel free to work out a frictionless micropayment method though.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#484

Post by raxxorraxor »

UqWBcuFx6NV4r wrote: post #363
raxxorraxor wrote: post #360

Earlier quoted context omitted.

I would like my browser to not pass their challenge and then flush support of services I cannot reach. This is the only way for them to stop, to really get on the nerves of their customers. Those might ignore it, but there are always alternatives.

That is delusional. Nobody is getting on anyone’s nerves, materially. The people who care about this are a rounding error of a rounding error.

I don't think it is delusional. Maybe ineffective. I think it is delusional to just accept these privacy invading measures as inevitable. Especially for software services today, there often is an alternative.

Most businesses don't have the luxury to be able to not care for the customer.

Cloudflare is a service provider for third parties, not the product I want to consume.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#485

Post by brandonwindson »

HappMacDonald wrote: post #481
thisislife2 wrote: post #46

Earlier quoted context omitted.

Just as criminal laws don't end all crimes, copyright laws and anti-scraping regulation won't end all scraping. But it will greatly reduce it and limit it to rogue actors. Two examples I can cite here are the laws against email spams and laws against unsolicited marketing calls - they had a definite impact in reducing both (even in India, from where I am, where implementation of laws are often lax).

One thing I want to know is how porn spam (that is, spam containing pornographic image attachments) vanished so suddenly in the early 2000s. It used to be a huge segment of spam, and then one day it all just vanished. So.. what made it go away, and how could learning about that help us make all the rest of it go away too?

Visa, Mastercard, and PayPal stopped processing payments for adult sites that used deceptive marketing. Hosting providers terminated accounts that sent image-based spam because the legal risk was too high. The same approach would work for other spam types. Target the payment processors, the hosting providers and make spam financially unsustainable.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#486

Post by jesterson »

kevincox wrote: post #398
jesterson wrote: post #344

Earlier quoted context omitted.

CF business model heavily relies on fearmongering, so what we can expect? They send these emails you know? "CF saved you XXX Gb of data and protected your from YYY attacks". I have few high load web sites which I turned CF on for a while. Knowing my traffic pretty well, I can say these "CF saved you XXX Gb of data and protected your from YYY attacks" is absolute bullshit with numbers greatly exaggerated. Since wwe ca…

I can only assume that every time I back out of these sites because I don't want to check the box or just don't want to wait a few seconds that is marketed to the site owner as a GREAT VICTORY as I am clearly a EVIL BOT that they have defended the site from.

Be sure they multiply your number by 100 at least. I was getting numbers for "evil bots" way exceeding possible good and malicious traffic.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#487

Post by akimbostrawman »

notafox wrote: post #474
spopejoy wrote: post #431

Earlier quoted context omitted.

What does profile-switching provide that switching containers within a single profile doesn't? Edit: I RTFA'd, containers can't adjust `privacy.resistfingerprinting`. Boo

- Independent set of extensions (independently configured) for each profile. - Independent set of settings/about:config parameters. You can't turn off, say, WebRTC completely for some profiles, while allowing it for other profiles. Different history. I remember accidentally nuking history of a few years - that wasn't fun. Now, you reduce blast radius. Proxy on/off or different proxies. Though, there's probably an ext…

>I remember accidentally nuking history of a few years - that wasn't fun.

If you are on linux I can't recommend enough using a COW filesystem like btrfs and zfs with snapshots. I can't count the amount of times i have wiped or edited something by mistake and then restored it within seconds with it.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#488

Post by croes »

tomrittervg wrote: post #455
croes wrote: post #424

Earlier quoted context omitted.

> Stronger protections that block more trackers, but may cause some sites to break. People already expect sites to break, so why holding back?

(n.b. I own these features in Firefox) There are three levels of protection: - ETP Standard (see [0] for the latest improvements we rolled out) - ETP Strict (we're working on things in Bugs 2036879 specifically this issue, 2037260, and more generally 2036786) - Resist Fingerprinting (RFP) These levels are something akin to "Wash your hands after using the subway", "Wear a mask on the subway", and "Wear a level B hazm…

I see three:

Standard

Strict

Custom

To me custom is something I define between Standard and Strict and not the next level after Strict. Strict already mentions that sites can break, so I'm pretty sure people associate the setting with breakage.

> Stronger protection, but may cause some sites or content to break.

Additionally Strict says :

Firefox blocks the following:

Social media trackers

Cross-site cookies in all windows

Tracking content in all windows

Cryptominers

Known and suspected fingerprinters

It's confusing if Known and suspected fingerprinters doesn't include resist fingerprinting. resist fingerprinting isn't even an option in Custom so how do ordinary users know where to set that option. You know, those users you say won't associate the Strict setting with breaking pages depite the fact that it clearly says so. Some kind of Schrödinger's user? Too dumb to understand the warning, but smart enough to know special settings?

You may avoid unnecessary bug reports that way but maybe only because users don't recognice that they are tracked per fingerprinting. It's not like websites would tell them.

Feels like Mozilla traded their time for my privacy.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#489

Post by akimbostrawman »

account42 wrote: post #406
fulafel wrote: post #307

WebGL fingerprinting is of course an attack and a unintended use of the WebGL API. Browser vendors should respond to this misuse somehow (reputation based blacklist?).

WebGL should just require a permission prompt, JS too really. No reason that every page you visits should be free to run stuff on your CPU and GPU.

WebGL does on Tor browser, LibreWolf and Mullvad Browser.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#490

Post by marysol5 »

ACCount37 wrote: post #64
b65e8bee43c2ed0 wrote: post #62

Earlier quoted context omitted.

it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.

At the same time: it sure works well enough to annoy anyone with a "bad ASN" IP with 80 captchas a day.

It's how I remember I've left my VPN on
Post reply on HN