Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

61–70 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#61

Post by surround »

jgrahamc wrote: post #20
thejosh wrote: post #12

Cloudflare is both a great thing and a terrible thing that has happened to the internet in recent years. Great in that they have a fantastic UI to add your site in, basically shielding the average user from attacks. Bad from a standpoint of that now only Google, Bing, and maybe other big search engines have the capabilities to actually crawl the internet now. I don't see us getting a massive innovation in search on t…

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

I trust that cloudflare will act responsibly in allowing small search engines through, but I really, really would rather not have to trust cloudflare. I don't believe that any organization can or will always act responsibly, which is why it's concerning that cloudflare controls so much of the internet.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#62

Post by emteycz »

mwcampbell wrote: post #57

There is no perfect solution, but I'm in favor of anything that's a net improvement in accessibility for disabled people, even if it's not ideal in some other way. So I'm disappointed to see this solution being shot down before it even gets deployed on a large scale.

Right before large scale deployment might be the last moment it's possible to prevent the large scale deployment.

Unfortunately corporations are not good at going a step back if the step forward is good for their business.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#63

Post by fuckyouriotshit »

swiley wrote: post #19

So visiting cloudflare sites with TOR requires you to identify yourself? That's not great.

Edit: I re-read the section on the U2F batch keys and understand that the design intent is to be unable to track individual tokens across sites (only batches of a size decided by the token manufacturer). It's not completely clear to me if the crypto involved is resistant to an attacker who can collect the handshakes and then later gets access to the key(s) that meant to be private to the manufacturer(s), but I acknowledge that the intent is decent. My points still stand, however.

This sort of "we can solve that problem; we just need to kill your privacy" seems to be par-for-the-course in SV-style companies.

I really wonder if anyone involved with building these systems has ever seriously thought about what could happen if the data collected (or that could be collected) by these systems was obtained by an adversary.

Not to mention the incredible incentive problems that are created by designing things that are designed in a way that _requires_ that individuals are tracked across the internet.

I know that CloudFlare is just one of many companies that is moving in this direction and they're certainly not the worst offenders when it comes to slowly murdering individual privacy (Facebook and Google are obviously far worse) but they have a uniquely powerful position due to the number of sites that use their DDoS protection and seem to be taking a casual disregard to the damage that they can do to people's privacy.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#64

Post by oefrha »

jgrahamc wrote: post #42
oefrha wrote: post #38

Earlier quoted context omitted.

Say I’m interested in building a small scale domain-specific search engine and only just started development. There’s no prototype yet and may never be. In this situation, how do you determine it’s a legit crawler? And what about crawlers with even more limited scopes (targeting only a handful of sites) that they can’t possibly be called search engines? Are they ever considered legit?

Be a good netizen? Respect robots.txt. Don't lie in your User-Agent. Don't crawl at a ridiculous rate. All those are a good starting point.

I think the problem is some IPs just straight-up always get CAPTCHAs from Cloudflare even if one’s a good netizen, respect robots.txt, not crawl at ridiculous rate, and not lie in the user agent. One reason is shared IP, which disproportionally affects people from third world countries as their ISPs don’t have enough IPv4 for everyone; but it also happened mysteriously to at least one dedicated IP I used in the past. Your confrontational tone is rather unfortunate, and the problem of course is that you don’t guarantee anything even if the user has done nothing wrong, as is manifest from the choice of the phrase “starting point”.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#65

Post by danShumway »

Complete aside, but I'm still not certain I understand the technical details of why Cloudflare can't uniquely identify users. I thought I knew how hardware keys worked, but apparently I don't.

If the key being shared is embedded in the device, even in a secure enclave or something, then my understanding was that would open the door for key extraction. If the key is unique per-device, then that's not a problem. But if the key is unique per-10,000 and stored statically on the device, then hacking one device means that key can be released to anyone and the entire pool can be imitated.

So if the above is correct, it can't be that a single private key shared across the entire company is stored on the device because that key would be getting constantly extracted and leaked by some determined hacker somewhere. But if it's a unique key per-device, then... I just can't figure out how validating that key wouldn't require transmitting unique information to somebody, whether it's Cloudflare or the device manufacturer.

Where am I going wrong? I feel like I'm misunderstanding something fundamental about how signing works on these devices, but I can't figure out what it is. If I buy a Yubikey, is it connecting to the manufacturer's servers and getting a new key each time it's used? I thought they worked offline.

Or are secure enclaves just much more secure than I think they are? Are we assuming that it's impossible to extract a private key from one of these devices?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#66

Post by SXX »

jgrahamc wrote: post #31
SXX wrote: post #29

Earlier quoted context omitted.

For instance there is no way for distributed search engines to work with CloudFlare. No, "contact me and we'll help" is not always a solution.

Please explain the problem (here or via email to me).

It is great that you care and I guess others are already provided some examples, but I'll add my own 2c here. Obvious problem is that centralized service like CloudFlare do create entry barrier and make large players on search and data mining markets even more entrenched than ever.

Recently your company announced partnership with Internet Archive, but if CloudFlare want to continue play a role as behevolent party everyone should have equal access to this data. Yeah it means that some bad actors will be able to easily scrap the web too, but...

CloudFlare service can't prevent scrapping anyway. There are shady residential proxy networks, services to bypass captcha and scrapping software like Zennoposter. It's possible to make scrapping more expensive, but bad actors don't care because they have money. Unfortunately enthusiasts, open source projects and small companies don't have enough resources to do the same.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#67

Post by ignoramous »

swiley wrote: post #19

So visiting cloudflare sites with TOR requires you to identify yourself? That's not great.

They implemented Privacy Pass for that, which is kind of neat [0] and related to another standard for authn viz. OPAQUE that I really like [1].

[0] https://github.com/privacypass

[1] https://news.ycombinator.com/item?id=25346632

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#68

Post by WORMS_EAT_WORMS »

arsome wrote: post #10

There's always CAPTCHA bypasses if you're willing to pay, there've been sites operating for decades that will take a captcha URL and spit out the appropriate response by just feeding it to humans. This is just a different way to make you pay - and arguably to something of less ill-repute, buying more U2F keys once yours get banned. This provides effective rate limiting and you can still get every key you automate ban…

Second this.

For a major sporting event, one of our sites was heavily targeted by “free TV streaming services” self promoting their stuff.

No amount of Google CAPTCHA or Cloudflare could stop it while keeping it online. Never seen anything like it in my life.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#70

Post by mwcampbell »

emteycz wrote: post #62
mwcampbell wrote: post #57

There is no perfect solution, but I'm in favor of anything that's a net improvement in accessibility for disabled people, even if it's not ideal in some other way. So I'm disappointed to see this solution being shot down before it even gets deployed on a large scale.

Right before large scale deployment might be the last moment it's possible to prevent the large scale deployment. Unfortunately corporations are not good at going a step back if the step forward is good for their business.

The trouble is that this change could be good not just for Cloudflare's business, but for people. If it turns out that this new CAPTCHA alternative is an improvement for users, but hurts some businesses who have to put up with a new form of abuse, I think that's a net win. Let's not stop it before it has a chance.
Post reply on HN