Earlier quoted context omitted.
>, I'd rather not even visit the site in the first place Until your bank, airline, and tax ministry start using them.
I vote with my wallet and dump misbehaving banks.
"Misbehaving" by protecting themselves
Cloudflare Turnstile requiring fingerprintable WebGL
491–500 of 508 posts
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#492Earlier quoted context omitted.
I can only assume that every time I back out of these sites because I don't want to check the box or just don't want to wait a few seconds that is marketed to the site owner as a GREAT VICTORY as I am clearly a EVIL BOT that they have defended the site from.
Be sure they multiply your number by 100 at least. I was getting numbers for "evil bots" way exceeding possible good and malicious traffic.
They are probably counting every single http request rejection as an evil bot
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#493Earlier quoted context omitted.
Why wouldn't PoW help? If it's tuned so that each device in that army takes 10 seconds instead of 10 milliseconds to make a request, have you not slowed the army down by a factor 1000?
You just need 1000x more zombie fridges, which may be still acceptable for some bad actors.
Sure. But this is kind of vacuously true for any real world DoS scenario. It's like saying "sure, your new weapons system might wipe out 999 out of every 1000 of the enemy's forces, but what does it matter, they can just scale up by a factor 1000 and we're back where we started".
Anything that amplifies the cost and effort required by the adversary by several orders of magnitude is worthwhile discussing.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#494Earlier quoted context omitted.
I haven't ever noticed Cloudflare having any issues on Firefox, so presumably that implies any unilateral actions in web standards have been worked around by CF to provide the service to Firefox as well.
I'm pretty frequently blocked by Cloudflare when I use Firefox on OpenBSD -- apparently it's too suspicious of a combination for their liking, or something. Even on Linux I've occasionally had issues. I've had to email site operators to ask them to change their configuration so I can actually be a customer of their business.
Oh dear. That is tricky. It must be a rare enough combination that it looks like automation.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#495Re: Cloudflare Turnstile requiring fingerprintable WebGL
#496Earlier quoted context omitted.
Why not? PoW challenge doesn't whitelist botnets. If the dumb scraper makes only get requests and doesn't solve the challenge, it doesn't matter how it connects, even if it's a perfectly hidden tor exit node.
Because the work would be done by the compromised residential device. No bothnet owner is going to care if their 100,000 rooted routers have to do a little more work. It’s still “free” from their perspective.
If botnet owner allows RCE, the botnet will just change the owner.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#497Earlier quoted context omitted.
It might depend on the tech stack. I run a small niche website but it has PHP and a database (MediaWiki/PHPBB) and without Cloudflare I'd estimate I'd need to spend several hundred dollars a month to handle the traffic. Traffic used to be tens of thousands of requests a day. AI has increased that to between 400k and 3M requests per day but it's not a smooth distribution. This is with bot fight mode on that greatly re…
That was my point. I was trying to be gentle by mentioning "unreasonable" things, but seriously — how did we get to the point where less than 6 requests per second (that's 500k requests per day) is considered a DDoS? I've spent some effort on optimizing my sites, but most of the effort was focused on avoiding unreasonable (stupid) work. Do I need a session for every request? No, I don't! Do I need a database fetch fo…
That's the traffic after rate limiting controls and bot fight mode. It's 3-4 million requests per day without bot fight mode and just rate limits. And as I said it's not a smooth distribution. Plus the requests are almost never for pages in cache. It's always stuff like loading all the message threads from the year 2000 or loading up the details of every page edit ever made to a wiki page.
If it was more static content it'd be easier, it's really the db being a bottle neck in a dynamic site.
Yes, the software could be better optimized but then I'd have to own the development of it. There is no reason a niche website should be getting millions of requests per day.
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#498Earlier quoted context omitted.
(n.b. I own these features in Firefox) There are three levels of protection: - ETP Standard (see [0] for the latest improvements we rolled out) - ETP Strict (we're working on things in Bugs 2036879 specifically this issue, 2037260, and more generally 2036786) - Resist Fingerprinting (RFP) These levels are something akin to "Wash your hands after using the subway", "Wear a mask on the subway", and "Wear a level B hazm…
first off, thank you for your service. second, would it be possible to make RFP appear as an extension like uBO, where it suggests sites to allow-list, or hints that the page might be broken and asks if you want to disable RFP? I'm more tech savvy than the average user, admittedly, but I've learned this pattern for uBO.
For a time RFP - by itself - could be enabled by web extensions. (It might still be possible, I don't recall if we removed it.) But it's a footgun because it became even easier for people to enable it by accident.
I can point you at a few things you could do if you wanted to pursue this:
1) We have a dev extension https://github.com/mozilla-extensions/fingerprinting-protect... that lets you enable/disable individual fingerprinting protections. We use to debug why something is broken.
2) granularOverrides allows you to enable/disable individual protections for a given website.
If you wanted this, you could go read https://docs.google.com/document/d/1FywogzvkWupoUoz4PcCp9nNd... ; then made an extension that made it easy to edit granular overrides (you couldn't directly set the preference, but you could produce the json you could copy/paste into the pref). You could do stuff with lists if you want. (Somewhere there was a FF fork that had a pretty impressive granularoverride list itself...) You'll be in this awkward spot where you don't have all the permissions to do what you want to do directly, but you can get yourself about.... 40 - 60% of the way there?
I would like to find a way to support power users while not making the problem worse (In https://ritter.vg/blog-telemetry.html I describe that the 'confused users think FF is broken' problem got so bad management wanted to just disable RFP entirely, but I was able to show that these users are a very vocal minority and the problem is not as bad as it seems) while also not giving myself a maintenance burden but... maybe there a path forward where this dev extension - that can do things normal extensions can't - could potentially get more functionality...?
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#499Earlier quoted context omitted.
There's a saying that if an idea is stupid, but it works, it's not stupid. If some computation is "useless" but it serves it's purpose, it's not useless. The reason why bitcoin network expends so much energy is down to tokenomics, not the system of PoW itself. At equilibrium we expect the power usage to be (blocks/hr) x (BTC/block) x ($/BTC) x (kWh/$), so it's a function of the BTC price and emission rate. PoW in oth…
I mean coal power plants work, so building new ones is not stupid by that standard. I think we have to expand the definition of stupid to include things that work but have net negative externalities. Not sure where PoW falls in that way of looking at things, but we should at least consider it. (Thinking about it, Captcha is PoW, just theoretically work by the human)
Necroing this, but perhaps you might be interested in some sort of BOINC-like PoW scheme for websites. This was a distributed computing project originially known as Seti@Home. It's not really practical for cryptocurrency PoW applications (despite its use in Gridcoin) due to the centralized nature of the challenge-response, but certainly more useful than captchas or hashes!
Re: Cloudflare Turnstile requiring fingerprintable WebGL
#500Earlier quoted context omitted.
Be sure they multiply your number by 100 at least. I was getting numbers for "evil bots" way exceeding possible good and malicious traffic.
They are probably counting every single http request rejection as an evil bot
I did some math, and even if they would count every http pass through together with rejection traffic, their numbers would still be greatly exaggerated.