Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 312 posts

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#71

Post by scarface_74 »

Hizonner wrote: post #68
scarface_74 wrote: post #66

Earlier quoted context omitted.

If I have a process that works for 95% of the people, why should I care about outliers who use Linux behind a VPN on a heavily customized version of Firefox?

Because they are standards compliant and you aren't, and you are legally required to provide an unsubscribe service or whatever without undue barriers around it.

For unsubscribe - yes.

Everything else - no.

But if I am using standards and they have an ad blocker that blocks some of the functioning of my site, am I also required to test my site against that?

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#72

Post by rad_gruchalski »

Hizonner wrote: post #68
scarface_74 wrote: post #66

Earlier quoted context omitted.

If I have a process that works for 95% of the people, why should I care about outliers who use Linux behind a VPN on a heavily customized version of Firefox?

Because they are standards compliant and you aren't, and you are legally required to provide an unsubscribe service or whatever without undue barriers around it.

> and you are legally required

Where. It’s global internet we communicate via.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#73

Post by michaelmior »

derefr wrote: post #44
shiomiru wrote: post #17

Earlier quoted context omitted.

The sad part is that it's trivial to get around CF's bot protection if you're writing a bot (just use curl-impersonate and buy residential IPs), but it's pretty much impossible to bypass as a human if their magical black box doesn't like your browser and/or IP address.

> it's pretty much impossible to bypass as a human if their magical black box doesn't like your browser and/or IP address There are residential-IP-backed VPN services that you can use just like commercial VPN services — but they're mostly built on the backs of botnets, so it's ethically questionable to use them.

FWIW, StarVPN claims to have "ethically sourced" IPs. That is, not from botnets. Their pricing is quite a bit higher than many (cheapest plan is $20/month), but could be worth trying.

https://www.starvpn.com/

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#74

Post by michaelmior »

solardev wrote: post #28
shiomiru wrote: post #17

Earlier quoted context omitted.

The sad part is that it's trivial to get around CF's bot protection if you're writing a bot (just use curl-impersonate and buy residential IPs), but it's pretty much impossible to bypass as a human if their magical black box doesn't like your browser and/or IP address.

How does it get around captchas?

curl-impersonate doesn't solve CAPTCHAs, but the goal is to look enough like a human that Cloudflare doesn't present a CAPTCHA in the first place.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#75

Post by rad_gruchalski »

Hizonner wrote: post #63
rad_gruchalski wrote: post #10

Earlier quoted context omitted.

They are not targeting people like you. Bots are the target. If you look like a bot, how are they going to distinguish?

Their problem. They are not entitled to make it other people's problem.

They solved their problem. No matter how upset you are about it, the rest of the matter is your problem.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#76

Post by _yb2s »

I had similar issues as an (also heavily customized) Firefox user, but was able to fix it by installing Cloudflare's Privacy Pass browser extension.

It seems ironic that as a human I can't seem to reliably prove I am a human with a realistic amount of effort via these systems, but having installed a specific automated browser extension does?

I am not a fan of Cloudflare and don't like the idea of running their software on my computer, but it seemed like the only options to continue using the internet at all.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#77

Post by 93po »

I wish we could popularize some extension that pays a penny per page load or something using some shitcoin both as a means to support our favorite sites but also to validate that I'm not a bot, or at least if I am, I am willing to spend a lot of money in a DDOS that goes directly in your pocket

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#78

Post by EGreg »

tokioyoyo wrote: post #22
nullc wrote: post #15

Earlier quoted context omitted.

Bot authors are lazy and won't until they have to.. once you do, you can then pretend they aren't bots and include them in the engagement numbers you feed prospective shareholders.

Agreed. From my past experiences though, a very good chunk of them will give up once there is a resistance. Basically, you want your bot protection to just be a little better than your competitor. Then the bot author will target them instead, because of the path of least resistance.

Outrun the friend not the bear? Hehe

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#79

Post by noprocrasted »

blakeashleyjr wrote: post #8

What I don't understand is why you have to protect areas that require login so harshly? If I can log in, especially with 2-factor, you can safely assume I am not a bot, or you have a larger problem. If I have entered bad credentials 5+ times, okay, you can start backing me off or challenging me. What am I missing? Fail2ban has been around a long time.

Problem is that a significant chunk of the technology industry still relies on "engagement" as its business model. The objective of slapping an overzealous bot protection system isn't to protect high-risk endpoints like logins/etc, it's to ensure a human is "engaging" and human time is being wasted by making even legitimate automated usage impossible.

From their perspective, the blocking of power users with unusual setups is actually a happy coincidence, as those are unlikely to "engage" with the product in the desired way (they run ad & spyware blockers, don't fall for dark patterns, and are more likely to fight back if they get defrauded by the corporation).

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#80

Post by hombre_fatal »

luckylion wrote: post #67
rustc wrote: post #53

Earlier quoted context omitted.

What other way would you suggest to protect a free service from bots? Cloudflare is often the easiest to implement and has a generous limit on their free plan.

Oh, they absolutely are, I don't disagree -- I use them too. But the immediate response to bots shouldn't be "make everyone go through a captcha". There's lots of nuance that you can tune to deal with your particular situation, but the first thing I'd do is block known bots or ASNs, set up a limit to trigger (bots usually don't make 1 document request a minute), set up higher limits for users who (seem to) have a val…

Fwiw, Cloudflare does do a multivariate confidence check which is why it has multiple tiers: no captcha, a one-click captcha, the annoying puzzle captcha once, the annoying puzzle captcha six times in a row.

> I'm a user, I'm logged in, I've posted before, I'm in good standing, yet when I go there, I need to solve a captcha.

Though consider the fact that taking over someone's account shouldn't give you (a spammer) unlimited access either. The spambots you see on Twitter are mostly cred-stuffed accounts. It's a hard problem. Existing accounts are more dangerous than fresh accounts.

Imo, "write your own password" should be a thing of the past. Services should just auto-gen a password or there should be a way to require the OS (like a password manager) to generate one to avoid cred-stuffing. We're letting down the average person by making them come up with unique passwords for every service instead of just helping them. Though I'm way off topic.

Post reply on HN