Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#1

Post by blakeashleyjr » Thu, Jan 02, 2025, 6:19 PM UTC

I travel often. Sometimes I use a VPN, sometimes I don't. I use a heavily customized Firefox config on Linux.

Cloudflare challenges have made large portions of the web unusable for me.

Some recent examples

  - The "unsubscribe" button in Indeed's job notification emails leads me to an impassable Cloudflare challenge. The "Contact Us" page is also behind an impassable Cloudflare challenge.
  - While migrating a non-profit off of A2 Hosting, their login forces me to re-enter credentials after failing a challenge, looping endlessly.
  - On a particularly ironic note, I tried to complain on the Cloudflare Forums—met with another impassable challenge.

When reachable, customer support always says "try a mobile data connection", "switch to Chrome", or some other variant of "too bad, so sad".

Is anyone else dealing with this mess?

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#2

Post by solardev » Thu, Jan 02, 2025, 6:33 PM UTC

You're collateral damage in the web's war against bots :(

Unfortunately, I think the Cloudflare challenges are designed to filter out users similar to your profile... once you stray far enough from the norm, it just looks like a bot / suspicious traffic to them. Statistically there's not enough users like you (privacy-conscious Linux users on nonstandard browsers) for them to really care enough to do anything about it. Site owners don't care either since you're usually like 1-2% of users at most, and typically also the same ones who block ads, etc., so they don't mind blocking you... it's sad, but I don't think there is really anything you can do about it except conform. It's an ongoing arms race and you're caught in the middle.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#3

Post by blakeashleyjr » Thu, Jan 02, 2025, 6:39 PM UTC

solardev wrote: post #2

You're collateral damage in the web's war against bots :( Unfortunately, I think the Cloudflare challenges are designed to filter out users similar to your profile... once you stray far enough from the norm, it just looks like a bot / suspicious traffic to them. Statistically there's not enough users like you (privacy-conscious Linux users on nonstandard browsers) for them to really care enough to do anything about i…

While you hit the nail on the head, I am still surprised that so many tools targeted at people like me (web hosting, developer tools, etc.) are protected that way.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#4

Post by Zaheer » Thu, Jan 02, 2025, 6:49 PM UTC

I'd expect this to increase with the proliferation of AI Crawlers and scraping becoming easier with AI.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#5

Post by kauegimenes » Thu, Jan 02, 2025, 6:51 PM UTC

blakeashleyjr wrote: post #3

solardev wrote: post #2

You're collateral damage in the web's war against bots :( Unfortunately, I think the Cloudflare challenges are designed to filter out users similar to your profile... once you stray far enough from the norm, it just looks like a bot / suspicious traffic to them. Statistically there's not enough users like you (privacy-conscious Linux users on nonstandard browsers) for them to really care enough to do anything about i…

While you hit the nail on the head, I am still surprised that so many tools targeted at people like me (web hosting, developer tools, etc.) are protected that way.

Its not only about protection, most web developers would use Cloudflare since its a free CDN and would increase the app load time considerably.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#6

Post by warkdarrior » Thu, Jan 02, 2025, 6:51 PM UTC

blakeashleyjr wrote: post #3

solardev wrote: post #2

You're collateral damage in the web's war against bots :( Unfortunately, I think the Cloudflare challenges are designed to filter out users similar to your profile... once you stray far enough from the norm, it just looks like a bot / suspicious traffic to them. Statistically there's not enough users like you (privacy-conscious Linux users on nonstandard browsers) for them to really care enough to do anything about i…

While you hit the nail on the head, I am still surprised that so many tools targeted at people like me (web hosting, developer tools, etc.) are protected that way.

Because if such hosting and developer tools are not protected against bots, the tools end up used for phishing, spamming, etc.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#7

Post by kauegimenes » Thu, Jan 02, 2025, 6:52 PM UTC

Can't you have a normal firefox profile for such cases? Do you have any javascript filters? I bet the issue must be related to configs messing with the JS runtime.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#8

Post by blakeashleyjr » Thu, Jan 02, 2025, 6:53 PM UTC

What I don't understand is why you have to protect areas that require login so harshly?

If I can log in, especially with 2-factor, you can safely assume I am not a bot, or you have a larger problem.

If I have entered bad credentials 5+ times, okay, you can start backing me off or challenging me.

What am I missing? Fail2ban has been around a long time.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#9

Post by Terr_ » Thu, Jan 02, 2025, 6:53 PM UTC

I'm really afraid of what kind of internet we'll have when these kinds of un-diagnosable un-appealable false-positives are not just transient blips, but become metadata companies use to blindly and permanently kill off accounts on other services.

I think it may have been what happened my since-2010 Reddit account was mysteriously killed a couple years ago, and literally the only cause I can think of is that I might've used the wrong public wifi for an evening.

Re: Tell HN: Impassable Cloudflare challenges are ruining my browsing experience

#10

Post by rad_gruchalski » Thu, Jan 02, 2025, 6:54 PM UTC

blakeashleyjr wrote: post #3

solardev wrote: post #2

You're collateral damage in the web's war against bots :( Unfortunately, I think the Cloudflare challenges are designed to filter out users similar to your profile... once you stray far enough from the norm, it just looks like a bot / suspicious traffic to them. Statistically there's not enough users like you (privacy-conscious Linux users on nonstandard browsers) for them to really care enough to do anything about i…

While you hit the nail on the head, I am still surprised that so many tools targeted at people like me (web hosting, developer tools, etc.) are protected that way.

They are not targeting people like you. Bots are the target. If you look like a bot, how are they going to distinguish?