Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

71–80 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#71

Post by EvanAnderson »

surround wrote: post #61
jgrahamc wrote: post #20

Earlier quoted context omitted.

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

I trust that cloudflare will act responsibly in allowing small search engines through, but I really, really would rather not have to trust cloudflare. I don't believe that any organization can or will always act responsibly, which is why it's concerning that cloudflare controls so much of the internet.

Yes. This. I believe that John Graham-Cumming is genuine in his statements in this thread re: "contact me if you're running afoul of our controls", for example. If he leaves Cloudflare, Cloudflare "turns evil", etc, then that's all out the window.

Individual companies having so much power gives me the willies.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#72

Post by nabla9 »

542458 wrote: post #33
nabla9 wrote: post #22

Earlier quoted context omitted.

There was once cs professor who claimed that the internet does not scale around 2000. Either things choke up or you need huge investments into networks. It turns out that he was right, sort of. The vanilla attach server into the internet, server-to-client IP-network is pretty much dead. It has been replaced with CDN's , private delivery networks, cache on top of cache. Cloudfare, Amazon, Google and MS are the connect…

Is it pretty much dead? Yeah, if you’re moving FAANG level traffic you need something more fancy than LAMP + an internet connection, but I’ve seen dozens and dozens of sites with a plain old no-cdn, no-pdn, LAMP tech stack. Working with startups might bias your view - lots of companies are running extremely boring setups and they work just great.

Respectfully, I think you miss the point.

The fact that 98% of traffic goes trough this new infrastructure, allows some still plug their server to the net raw and their traffic still gets trough.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#73

Post by thejosh »

jgrahamc wrote: post #20
thejosh wrote: post #12

Cloudflare is both a great thing and a terrible thing that has happened to the internet in recent years. Great in that they have a fantastic UI to add your site in, basically shielding the average user from attacks. Bad from a standpoint of that now only Google, Bing, and maybe other big search engines have the capabilities to actually crawl the internet now. I don't see us getting a massive innovation in search on t…

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

Hi!

Thanks for taking the time to reply.

You mentioned about "legit" crawlers, what defines a "legit" crawler in the eyes of Cloudflare, and what happens when Cloudflare suddenly decides it does not want to honour that "agreement"? What happens if/when Cloudflare is sold, or the contact who greenlit these smaller "legit" crawlers moves on and decides that it no longer agrees with said website anymore?

Is a price comparison site a "legit" crawler? What defines a "bot" vs a "crawler" in the eyes of Cloudflare?

Would you need to notify your customers that you now also allow additional crawlers access to their sites, or would they need to opt into it via the Cloudflare dashboard? What happens when you have a falling out with my said company (it happens, relationships sour) and suddenly we can't make contact, then suddenly customers websites aren't being scraped because we're bots?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#75

Post by [deleted] »

arsome wrote: post #10

There's always CAPTCHA bypasses if you're willing to pay, there've been sites operating for decades that will take a captcha URL and spit out the appropriate response by just feeding it to humans. This is just a different way to make you pay - and arguably to something of less ill-repute, buying more U2F keys once yours get banned. This provides effective rate limiting and you can still get every key you automate ban…

[deleted]

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#76

Post by fuckyouriotshit »

swiley wrote: post #19

So visiting cloudflare sites with TOR requires you to identify yourself? That's not great.

Visiting many CloudFlare sites with Tor was impossible the last time I checked because their CAPTCHA is broken and has been for a long time.

I know for a fact that there are staff at CloudFlare who are aware of this problem but nothing has changed, so I guess that they don't care that they are making some sites unavailable to anyone who has to use Tor.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#77

Post by emteycz »

mwcampbell wrote: post #70
emteycz wrote: post #62

Earlier quoted context omitted.

Right before large scale deployment might be the last moment it's possible to prevent the large scale deployment. Unfortunately corporations are not good at going a step back if the step forward is good for their business.

The trouble is that this change could be good not just for Cloudflare's business, but for people. If it turns out that this new CAPTCHA alternative is an improvement for users, but hurts some businesses who have to put up with a new form of abuse, I think that's a net win. Let's not stop it before it has a chance.

I agree, but what if it's not and going a step back is then refused? Is there really no other way of testing than large scale deployment?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#78

Post by ignoramous »

The article here ignores the view of the Web that Cloudflare has, which coupled with "something you have" (the U2F keys) makes for a compelling alternative to CAPTCHAs.

Sure, bots can automate keys, but those keys could also be banned just as well. Cloudflare only needs to know which ones are the good keys and track those forever. This means, for every non-bot out there, the CAPTCHAs are as good as gone.

The genius of Cloudflare here is that they (ab)use WebAuthn, which can also be implemented on Android and iOS natively. Before you know it, Cloudflare has built an identity platform (where it may not be helpful for KYC) is plenty useful for websites Cloudflare fronts. Imagine never having to bother with user registration and authentication and bots... that's the next extension I see to all of this.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#79

Post by garaetjjte »

arsome wrote: post #10

There's always CAPTCHA bypasses if you're willing to pay, there've been sites operating for decades that will take a captcha URL and spit out the appropriate response by just feeding it to humans. This is just a different way to make you pay - and arguably to something of less ill-repute, buying more U2F keys once yours get banned. This provides effective rate limiting and you can still get every key you automate ban…

If I understand it correctly, you cannot ban attestation key without potentially banning lots of legitimate users.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#80

Post by ComodoHacker »

Is CAPTCHA a necessity only in ad-sponsored web? Is there other compelling use-case for it?

Can we make CAPTCHA obsolete with decent micropayments solution, when you pay for every transaction with every website, just like we pay for every drop of water we use? Perhaps ISPs could handle it for us?

Post reply on HN