Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

501–508 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#501

Post by danielheath »

Chris2048 wrote: post #378
mootothemax wrote: post #121

Earlier quoted context omitted.

Exactly. I’m constantly amazed at how little you actually need to bypass CF, Amazon, Azure WAFs and so on (Incapsula springs to mind too). When you look at the code you’ve come up with, it’s actually quite small and compact. More to the point, these systems actually help scraping because proof of work unlocks essentially unlimited scraping, in my experience. That said - from my experience on the other side, sure you…

What do you mean by ~"PoW unlocks unlimited scraping"?

Usually after you solve the POW challenge, sites let you make a lot of requests before asking you to complete another.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#502

Post by AlexeyBelov »

codedokode wrote: post #323
ethin wrote: post #164

Earlier quoted context omitted.

The problem is what is the alternative? I'm (not) defending them or this practice by any measure, but we all know what happens if you just open your site up without these, especially with AI bots which hammer servers and are in effect a legalized DDoS system. I've hated CAPTCHAs ever since I first encountered them and I can't wait for them to just finally die a permanent death, but I also don't know how we solve the…

> AI bots which hammer servers You can easily calculate which IPs/networks bots are using by looking at where most traffic comes from and who requests lot of pages with non-human speed.

Each IP address is either from a residential proxy network, or from AWS / GCP / DigitalOcean. And each IP requests at human speed. 1000 of them are an issue though.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#503

Post by dotancohen »

BenjiWiebe wrote: post #449
Dylan16807 wrote: post #321

Earlier quoted context omitted.

> There are tradeoffs, suggesting "shut down your website unless you provide access everywhere" is worse on all fronts for everyone. Maybe, maybe not. If block-heavy websites shut down entirely, we lose some content, but other content moves to block-minimal sites and the average user might be able to access more . Also if there's no blocking crutch, and people get pushed into shutdown and are mad about it, they might…

Well I administer an ecommerce site, and for the checkout page I block everything besides Canada and USA. Because those are the only two countries that we've ever in the life of our business, had a legitimate order from. It prevents the majority of credit card testing, but it is tempting to apply it to the whole site to reduce traffic and server load.

Is be seriously pissed off if I invested the time to build a shopping cart and got to the order screen just to be turned away. I hope that you have a clear message somewhere that you do not ship outside the US and Canada.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#504

Post by codedokode »

AlexeyBelov wrote: post #502
codedokode wrote: post #323

Earlier quoted context omitted.

> AI bots which hammer servers You can easily calculate which IPs/networks bots are using by looking at where most traffic comes from and who requests lot of pages with non-human speed.

Each IP address is either from a residential proxy network, or from AWS / GCP / DigitalOcean. And each IP requests at human speed. 1000 of them are an issue though.

If you aggregate over a day, it might become more obvious. Also, datacenter network is a big red flag.

By the way, what's your opinion about running a cryptominer on requests from datacenter and bot IPs?

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#505

Post by rfl890 »

LelouBil wrote: post #335
rfl890 wrote: post #275

Earlier quoted context omitted.

True, but that's at the discretion of the content author/publisher, not Cloudflare Turnstile.

It's the publisher that enabled Turnstile.

I don't think publishers have some sort of desire for their visitors to have their information collected by Cloudflare; they usually just enable it to protect their website from bots.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#506

Post by esrauch »

sandeepkd wrote: post #191
esrauch wrote: post #146

Earlier quoted context omitted.

> Bot protection with fingerprinting is just an illusion. Any signals like this which is on client side can be spoofed by an above average person. At the upper bound, fraud can always be committed by paying real people with real accounts to perform the desired action in a way that is 100% truly indistinguishable from organic. There's fundamentally actual prevention technique at the limit. So the entire game is only "…

> entire game is only "increasing the costs until it's not viable ROI", not "holistically prevent", which is why fingerprinting is a relevant technique here. As per cloudlare's own report, about 78% of the DDOS attacks are at the network layer where the fingerprinting technique is not useful. DDOS is done against targets for certain reasons, most businesses are not even viable targets for everyone. However letting ev…

Fingerprinting to detect bots seems mostly relevant for things which are not DOS, so that percentage doesn't seem like the relevant one.

Bots manipulate review scores, posting link spam to other users, crawl your database that isn't open to crawl, etc.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#507

Post by BenjiWiebe »

dotancohen wrote: post #503
BenjiWiebe wrote: post #449

Earlier quoted context omitted.

Well I administer an ecommerce site, and for the checkout page I block everything besides Canada and USA. Because those are the only two countries that we've ever in the life of our business, had a legitimate order from. It prevents the majority of credit card testing, but it is tempting to apply it to the whole site to reduce traffic and server load.

Is be seriously pissed off if I invested the time to build a shopping cart and got to the order screen just to be turned away. I hope that you have a clear message somewhere that you do not ship outside the US and Canada.

Yes it only allows US as the shipping address, and only US/Canada as billing address. The only reason we even allow Canada billing is because some of my relatives (Canadian) will order it and have it shipped to a parcel service on the US side of the border.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#508

Post by CrimsonRain »

dotancohen wrote: post #211
CrimsonRain wrote: post #160

Earlier quoted context omitted.

I'm one of those who have enabled cloudflare on all of the sites I maintain. Additionally, Added turnstile on every form. I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. Recently I also hard blocked all IPs from china Singapore India Pakistan Russia and whole of africa. Do I want to do it? No. But the amou…

> I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. So why not just shut down the website? Or remove the form entirely? That will ensure that you get no spam, right? One of the core tenets of system design is Availability. If your service is not available - if your forms are blocking legitimate users - then…

It is available to 99.9% of target demographic.

If you are getting blocked by CloudFlare, you are most likely not our demographic.

And there's always email address given in form submission, so a couple of users (like less than 5), emailed about the block and I added rules for each of them.

Better than taking down the whole thing because of bots scraping the site 5x more rate than humans.

Post reply on HN