Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

blog.cloudflare.com

Post reply on HN
Print view View original

71–80 of 82 posts

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#71

Post by kube-system »

boltzmann-brain wrote: post #69
kube-system wrote: post #9

Earlier quoted context omitted.

That depends on whether you can trust the browser. For example, browsers have long had flags to indicate whether they’re being driven by webdriver, but you can simply recompile the browser without those flags.

is it really just "simply recompile"? I would assume some intensive patching and learning would be necessary, especially for someone who isn't familiar with the source or the build process.

Sometimes even more simple -- there are some methods people use that are as simple as "copy and paste this javascript that overwrites some properties". There's a lot of people scraping the web, so there's somebody out there that has done the work for you already.

My point is, you don't really know what software is connecting to your web server.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#72

Post by yjftsjthsd-h »

ectopod wrote: post #70
byteduck wrote: post #56

Earlier quoted context omitted.

Interesting. I wonder what other factors you might have going against you causing CF to captcha you - I have my Firefox loaded up with almost every ad-blocking, privacy, and anti-fingerprinting extension I could think of, but I rarely get CAPTCHAs.

I block cookies and js. Cloudflare doesn't like that.

Ah yes, the classic "we care about security and privacy so much that we're going to force you to enable the biggest exploit vectors" move; classic Cloudflare:)

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#73

Post by duskwuff »

boltzmann-brain wrote: post #69
kube-system wrote: post #9

Earlier quoted context omitted.

That depends on whether you can trust the browser. For example, browsers have long had flags to indicate whether they’re being driven by webdriver, but you can simply recompile the browser without those flags.

is it really just "simply recompile"? I would assume some intensive patching and learning would be necessary, especially for someone who isn't familiar with the source or the build process.

If you're automating a browser, you're probably technical enough to compile a patched web browser -- or, at least, to use someone's script to compile one, or to download one that someone else has built.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#75

Post by ChrisArchitect »

My problem with this is I want to use the CAPTCHA to deter humans from continuing. Letting them thru automatically allows spammers/attackers to just continue on, but many will actually skip pages/sites where they have to do the CAPTCHA etc.

This helps the bot problem, but doesn't solve the SPAM problem.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#76

Post by groffee »

jallen_dot_dev wrote: post #39
eastdakota wrote: post #10

This is yet another example of Cloudflare centralizing the web. I’m tired of this. Sure the only previously viable solution was ReCAPTCHA from Google. But it’s Google. I depend on them for search. And, sure, their business model depends on them being able to track me online. But I know them. And it’s hard for me to live without them. So I’m ok with depending on them, but I worry about further centralization of the In…

Is anyone else worried about how Cloudflare keeps putting out great solutions day after day? They're getting too big because people are too satisfied with them. That's a bad thing, because one day in the future they might take away or change these offerings. We need shittier solutions. That way we never feel the pain of once having a good solution to a problem and then losing it.

Cloudflare is a cancer and a lot of people are expressing that same sentiment. I think maybe only non-technical people are satisfied with them because they don't have a deeper understanding of what's happening.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#77

Post by jallen_dot_dev »

cowtools wrote: post #64
jallen_dot_dev wrote: post #39

Earlier quoted context omitted.

Is anyone else worried about how Cloudflare keeps putting out great solutions day after day? They're getting too big because people are too satisfied with them. That's a bad thing, because one day in the future they might take away or change these offerings. We need shittier solutions. That way we never feel the pain of once having a good solution to a problem and then losing it.

great solutions is maybe an overstatement. If you build a bridge that puts everyone else out of business, and later discriminate on what traffic is allowed on the bridge, and after that you put an expensive toll booth on that bridge, that's a problem for everyone else if no one else can compete. At some point, you are doing society a disservice. At some point, great solutions become meager solutions by merit of a mon…

How did anyone cross the river before the bridge was built? If the bridge falls into disrepair or they start charging people an arm and a leg to use it, what stops someone else from coming along and building a better bridge? If Bridgeflare abuses their market position to prevent anyone else from building bridges then that could be rectified with government intervention, as in any other industry. I just don't get why there is so much FUD when they haven't, as far as I've seen, done anything to warrant it.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#78

Post by jallen_dot_dev »

groffee wrote: post #76
jallen_dot_dev wrote: post #39

Earlier quoted context omitted.

Is anyone else worried about how Cloudflare keeps putting out great solutions day after day? They're getting too big because people are too satisfied with them. That's a bad thing, because one day in the future they might take away or change these offerings. We need shittier solutions. That way we never feel the pain of once having a good solution to a problem and then losing it.

Cloudflare is a cancer and a lot of people are expressing that same sentiment. I think maybe only non-technical people are satisfied with them because they don't have a deeper understanding of what's happening.

Ok so the reason this painfully predictable reaction every time Cloudflare is on HN is because HNers have such a deep understanding of "what's happening." Got it.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#79

Post by homero »

eastdakota wrote: post #10

This is yet another example of Cloudflare centralizing the web. I’m tired of this. Sure the only previously viable solution was ReCAPTCHA from Google. But it’s Google. I depend on them for search. And, sure, their business model depends on them being able to track me online. But I know them. And it’s hard for me to live without them. So I’m ok with depending on them, but I worry about further centralization of the In…

This is the CEO and I love Cloudflare. Don't forget your roots.

Re: Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare

#80

Post by snotrockets »

mwcampbell wrote: post #46
yjftsjthsd-h wrote: post #44

Cloudflare: "Cloudflare has a long track record of investing in user privacy, which we will continue with Turnstile." Also Cloudflare: Tracks and fingerprints everyone, and blocks anyone who hardens their browser ("First we run a series of small non-interactive JavaScript challenges gathering more signals about the visitor/browser environment. Those challenges include proof-of-work, proof-of-space, probing for web AP…

There are no perfect solutions. In the arms race to protect against abuse, I'll take the solution that's more accessible, particularly to people that are discriminated against by CAPTCHAs, such as deafblind people.

It's not a race when you arm both sides, as cloudflare did by hosting known abusers for years, working hard to shield them from the consequences of their actions.
Post reply on HN