Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

blog.cloudflare.com

Post reply on HN
Print view View original

61–70 of 82 posts

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#61

Post by toastercat »

EFruit wrote: post #15

As much as I _despise_ modern ReCAPTCHA, I have always been able to pass the challenge eventually; it has never flatly rejected me with no recourse. If I made a mistake or was insufficiently human for it, I got a new challenge and tried again. There are apocryphal stories of Google tar-pitting users with it, but I have never seen it in action. If this judges the browser more than the user, what do I do when the brows…

It 100% is true that using ReCAPTCHA on privacy-oriented browsers can make ReCAPTCHA unbearable. As a Firefox user, I relate to others who've faced CAPTCHAs where the images fade-in unbearably slow, and even after painstakingly selecting the correct images, it will fail and say "nope try again", repeating the cycle.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#62

Post by yjftsjthsd-h »

byteduck wrote: post #56
mdaniel wrote: post #53

Earlier quoted context omitted.

> to protect against abuse I would actually be on-board with such things if this were against abuse but it's not -- it's preemptively assigning blame, since my copy of Firefox is not modified in any way except uBO but CF loves to captcha it. The other stories in every one of these captcha threads, and the majority of the CloudFlare announcements at all, demonstrate this isn't isolated to "oops, our bad" but a systemi…

Interesting. I wonder what other factors you might have going against you causing CF to captcha you - I have my Firefox loaded up with almost every ad-blocking, privacy, and anti-fingerprinting extension I could think of, but I rarely get CAPTCHAs.

Possibly IP address; Cloudflare doesn't like cgnat/shared addresses, or even if you just happen to be in a subnet they don't like.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#64

Post by cowtools »

jallen_dot_dev wrote: post #39
eastdakota wrote: post #10

This is yet another example of Cloudflare centralizing the web. I’m tired of this. Sure the only previously viable solution was ReCAPTCHA from Google. But it’s Google. I depend on them for search. And, sure, their business model depends on them being able to track me online. But I know them. And it’s hard for me to live without them. So I’m ok with depending on them, but I worry about further centralization of the In…

Is anyone else worried about how Cloudflare keeps putting out great solutions day after day? They're getting too big because people are too satisfied with them. That's a bad thing, because one day in the future they might take away or change these offerings. We need shittier solutions. That way we never feel the pain of once having a good solution to a problem and then losing it.

great solutions is maybe an overstatement. If you build a bridge that puts everyone else out of business, and later discriminate on what traffic is allowed on the bridge, and after that you put an expensive toll booth on that bridge, that's a problem for everyone else if no one else can compete. At some point, you are doing society a disservice. At some point, great solutions become meager solutions by merit of a monopoly's ownership.

The solution is to make the internet itself resilient to this mode of attack. Not to create a single company big enough to gatekeep and spy on the whole network and to just trust them to act virtuously forever.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#65

Post by mdaniel »

byteduck wrote: post #56
mdaniel wrote: post #53

Earlier quoted context omitted.

> to protect against abuse I would actually be on-board with such things if this were against abuse but it's not -- it's preemptively assigning blame, since my copy of Firefox is not modified in any way except uBO but CF loves to captcha it. The other stories in every one of these captcha threads, and the majority of the CloudFlare announcements at all, demonstrate this isn't isolated to "oops, our bad" but a systemi…

Interesting. I wonder what other factors you might have going against you causing CF to captcha you - I have my Firefox loaded up with almost every ad-blocking, privacy, and anti-fingerprinting extension I could think of, but I rarely get CAPTCHAs.

> I wonder what other factors

Yes, and that's my point: it's not action that the user can take to resolve accusations, and it's not because of abusive behavior it's just `response.status(200 if random.randbool() else 403)`

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#66

Post by boltzmann-brain »

toastercat wrote: post #61
EFruit wrote: post #15

As much as I _despise_ modern ReCAPTCHA, I have always been able to pass the challenge eventually; it has never flatly rejected me with no recourse. If I made a mistake or was insufficiently human for it, I got a new challenge and tried again. There are apocryphal stories of Google tar-pitting users with it, but I have never seen it in action. If this judges the browser more than the user, what do I do when the brows…

It 100% is true that using ReCAPTCHA on privacy-oriented browsers can make ReCAPTCHA unbearable. As a Firefox user, I relate to others who've faced CAPTCHAs where the images fade-in unbearably slow, and even after painstakingly selecting the correct images, it will fail and say "nope try again", repeating the cycle.

That's true, ReCAPTCHA is a pain in the butt on Tor Browser and the likes. So are similar alternatives.

However, the honest truth is that nothing that comes out of Cloudflare should be trusted as "privacy oriented".

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#67

Post by boltzmann-brain »

yjftsjthsd-h wrote: post #62
byteduck wrote: post #56

Earlier quoted context omitted.

Interesting. I wonder what other factors you might have going against you causing CF to captcha you - I have my Firefox loaded up with almost every ad-blocking, privacy, and anti-fingerprinting extension I could think of, but I rarely get CAPTCHAs.

Possibly IP address; Cloudflare doesn't like cgnat/shared addresses, or even if you just happen to be in a subnet they don't like.

> Cloudflare doesn't like

and theeeeeeeeeere's your problem.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#68

Post by boltzmann-brain »

zagrebian wrote: post #4

Can’t CAPTCHA be integrated into the browser? Can’t the browser vouch for the user?

you're being downvoted, but while the question you pose proposes a bad idea, it is a good question that resulted in a lot of interesting conversation, so you get my upvote.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#69

Post by boltzmann-brain »

kube-system wrote: post #9
zagrebian wrote: post #4

Can’t CAPTCHA be integrated into the browser? Can’t the browser vouch for the user?

That depends on whether you can trust the browser. For example, browsers have long had flags to indicate whether they’re being driven by webdriver, but you can simply recompile the browser without those flags.

is it really just "simply recompile"? I would assume some intensive patching and learning would be necessary, especially for someone who isn't familiar with the source or the build process.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#70

Post by ectopod »

byteduck wrote: post #56
mdaniel wrote: post #53

Earlier quoted context omitted.

> to protect against abuse I would actually be on-board with such things if this were against abuse but it's not -- it's preemptively assigning blame, since my copy of Firefox is not modified in any way except uBO but CF loves to captcha it. The other stories in every one of these captcha threads, and the majority of the CloudFlare announcements at all, demonstrate this isn't isolated to "oops, our bad" but a systemi…

Interesting. I wonder what other factors you might have going against you causing CF to captcha you - I have my Firefox loaded up with almost every ad-blocking, privacy, and anti-fingerprinting extension I could think of, but I rarely get CAPTCHAs.

I block cookies and js. Cloudflare doesn't like that.
Post reply on HN