Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Turnstile requiring fingerprintable WebGL

hacktivis.me

Post reply on HN
Print view View original

81–90 of 508 posts

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#81

Post by pwg »

xena wrote: post #73
phoronixrly wrote: post #57

Earlier quoted context omitted.

How does Anubis stop bots?

Bots don't execute JavaScript or follow complicated redirects.

Bots don't [currently] execute JavaScript or follow complicated redirects.

They don't now, but enough "high value to the bots" pages turning on JS or complicated redirects will simply result in the bot authors adding JS execution or redirect following so they can continue "botting" the sites they want to scrape.

It's a hole with no bottom. Each one-up on the anti-bot side will eventually be handled on the bot side.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#82

Post by [deleted] »

pmontra wrote: post #78
gruez wrote: post #69

Earlier quoted context omitted.

Depends on what type of scraping you're trying to stop. For the dumb scrapers that would try to scrape every page on a git forge (for which there are a bazillion pages for a modest project, because of how the site works), yeah it might deter them enough to stop. For anything high value (eg. reddit comments or retail prices), 10s of cpu time isn't going to stop them.

It will not scare away bots but 10 seconds of wait (CPU or only a sleep) will turn away many real users. "This site is so slow, I'll use something else." A kind of reverse captcha.

[deleted]

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#83

Post by gruez »

JoshTriplett wrote: post #80
gruez wrote: post #59

Earlier quoted context omitted.

Bad optics aside, it doesn't actually reflect reality. See my other comment. You can enable basically all the privacy settings and still pass turnstile. Tor browser in a VM passes it, of all things. https://litter.catbox.moe/gaizpk692bhhs6b7.png

Any idea what the difference is between your setup and the one in the article that failed with fingerprint-resistance enabled?

He's using a custom browser, apparently: https://hacktivis.me/projects/badwolf

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#85

Post by notafox »

PearlRiver wrote: post #32
denysvitali wrote: post #11

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…

This is why I have two separate browsers. If you want to do official stuff like paying for things you need to get through cloudflare.

You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles.

Firefox with a non-default profile can be created like that:

  ./firefox -CreateProfile "profile-name /home/user/.mozilla/firefox/profile-dir/"
  # For, say, cloudflare that would be:
  ./firefox -CreateProfile "cloudflare /home/user/.mozilla/firefox/cloudflare/"
And you can launch it like that:

  ./firefox -profile "/home/user/.mozilla/firefox/profile-dir/"
  # For cloudflare that would be:
  ./firefox -profile "/home/user/.mozilla/firefox/cloudflare/"
So, given that /usr/bin/firefox is just a shell script, you can

    - create a copy of it, say, /usr/bin/firefox-cloudflare
    - adjust the relevant line, adding the -profile argument
If you use an icon to run firefox (say, /usr/share/applications/firefox.desktop), you'll need to do copy/adjust line for the icon.

Of course, "./firefox" from examples above should be replaced with the actual path to executable. For default installation of Firefox the path would be in /usr/bin/firefox script.

So, you can have a separate profiles for something sensitive/invasive (linkedin, cloudflare, shops, banks, etc.) and then you can have a separate profile for everything else.

And each profile can have its own set of extensions.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#86

Post by notafox »

helterskelter wrote: post #51
PearlRiver wrote: post #32

Earlier quoted context omitted.

This is why I have two separate browsers. If you want to do official stuff like paying for things you need to get through cloudflare.

Firefox added profile switching recently. Works good. (That said, I still keep separate machines. One for doing "official" things, the other for everything else)

> Firefox added profile switching recently.

I think this was as recent as 25 years ago?

Recently they added some new UI. There was and still is (I think) classic Profile Manager UI, which you can launch with

  ./firefox -ProfileManager
or access UI in about:profiles.

But you don't have to use any of those anyway - see my comment above (a response to parent).

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#87

Post by shideneyu »

ACCount37 wrote: post #64
b65e8bee43c2ed0 wrote: post #62

Earlier quoted context omitted.

it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.

At the same time: it sure works well enough to annoy anyone with a "bad ASN" IP with 80 captchas a day.

exactly that's what I was thinking... like the day they provided a solution to the issue they posed

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#88

Post by ranguna »

Wowfunhappy wrote: post #17
malka1986 wrote: post #15

Earlier quoted context omitted.

> keeping out bot You can forget about it. It is not possible. Simple as that.

Let's say I'm selling concert tickets. How do I prevent bots from buying up all the tickets and scalping them?

Do it like plane tickets do, tie a ticket to an identity + buyback up to a week or so before the concert in case someone wants to cancel (or authorize the transfer and capture only a week before). Ask for ID and ticket at the entrance.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#89

Post by QuantumNomad_ »

timpera wrote: post #42
ImPostingOnHN wrote: post #39

Earlier quoted context omitted.

The tool "Anubis" uses proof of work instead

Anubis often takes more than 60 seconds to complete on low-end devices (especially old smartphones). It seems like there's no good solution.

But after you’ve completed the Anubis PoW challenge for a site, it remains valid for some amount of time.

So it’s not quite as horrible as it sounds.

I have setting up Anubis for my own sites on my todo list. And I wish more people did it too. I don’t really mind waiting a little bit extra every now and then before the page loads. What I do mind is ReCaptcha asking me to click all the pictures with buses in them etc. And especially when I have to do it several times over before it’s happy. I’d rather wait a minute for a page to load than to ever solve a ReCaptcha again, if given the choice.

Re: Cloudflare Turnstile requiring fingerprintable WebGL

#90

Post by [deleted] »

ajb wrote: post #75
helterskelter wrote: post #51

Earlier quoted context omitted.

Firefox added profile switching recently. Works good. (That said, I still keep separate machines. One for doing "official" things, the other for everything else)

Odd - they've had that for years, but only on the command line. Wonder if it's different under the hood? They also have firefox containers which also never quite became a first-class feature (you have to install a plugin).

[deleted]
Post reply on HN