[HN Gopher] Tell HN: Cloudflare verification is breaking the int...
___________________________________________________________________
Tell HN: Cloudflare verification is breaking the internet
Across many different pages including science journals, ChatGPT,
and many others, CloudFlare verification goes into an infinite loop
of: 1. "Verify you are a human" 2. Check the box or perform some
other type of rain dance 3. "Please stand by, while we are
checking your browser..." 4. Repeat step 1 I'm on Fedora Linux 37
using Firefox 110. The workaround is to use Chrome. After
experiencing this dozens of times and getting annoyed of needing to
use Chrome, I finally went and deleted all my cookies and cache
which I had been dreading to do. It did not help. I don't have a
CloudFlare account so I wrote up a detailed post on their community
forums. I offered a HAR file and was willing to do diagnostics. It
received no responses and it was auto-closed. It's unacceptable
that CloudFlare is breaking the internet while offering no
community support. Edit: I'm in Texas. I'm not using a VPN or Tor,
just AT&T Fiber. I don't have ad-blockers. No weird extensions.
Nothing special (besides being on Linux). Edit2: Since this got
traction, I opened a new community post:
https://community.cloudflare.com/t/infinite-verify-you-are-a-human-
loop/503065 To be clear, I'm not against CloudFlare doing DDoS
protection, etc., but it can't be breaking the internet _while
ignoring community posts on it_. Edit3: The CloudFlare team has
engaged. Thank you HN!
Author : statquontrarian
Score : 356 points
Date : 2023-04-28 15:38 UTC (7 hours ago)
| eis wrote:
| > I don't have a CloudFlare account so I wrote up a detailed post
| on their community forums. I offered a HAR file and was willing
| to do diagnostics. It received no responses and it was auto-
| closed.
|
| Cloudflare has some weird thing going on there if you want to
| report bugs. If you try to open a support request to report the
| bug it'll be auto-closed stating only paid accounts can submit
| support tickets. Then it says if you really are sure then post it
| in the community. Did that but the post was auto deleted as spam.
| All I was trying to do was report a bug in their dashboard. Did
| someone internally game the KPI for open support issues? :)
| version_five wrote:
| I haven't really had bad luck with Cloudflare, but for reCaptcha,
| I make it a point of contacting orgs that use it and telling them
| they've lost a sale as a result of their choice. The replies I've
| gotten are usually along the lines of "we have to use it for
| securit" and I know they don't really care, but all I really see
| that I can do is complain, and if they get enough complaints
| hopefully they try something else
| kccqzy wrote:
| As someone who had actually recommended a team to use reCAPTCHA
| and implemented it, it's really not that they don't care about
| losing a sale, it's that they _lose more money_ by not using
| reCAPTCHA and letting bots run rampant. It 's a business
| decision: they are still ahead even after accounting for lost
| sales due to a small minority of people who are opposed to
| reCAPTCHA and the money they pay for reCAPTCHA (which may be
| zero).
|
| Obviously most small sites are not actively targeted by bots
| and using reCAPTCHA is a waste of money and people's time. But
| if you are, reCAPTCHA is a godsend.
| thewebcount wrote:
| > small minority of people who are opposed to reCAPTCHA
|
| It's not so much that "people ... are opposed to reCAPTCHA",
| but that for some they can't make it work.
| pooper wrote:
| Just for debugging, can you please create a fresh Firefox profile
| and try again?
|
| I am also in Texas. Also using Mozilla Firefox on Fedora, on
| Spectrum / Road runner / Charter.
|
| https://support.mozilla.org/en-US/kb/profile-manager-create-...
|
| I personally don't mess with profiles. I download firefox
| developer binaries and put them in ~/bin folder which uses a
| different profile by default (no extensions for web dev test).
| leguminous wrote:
| I use Firefox on Fedora as well, but with Xfinity (IPv6 support
| and no CGNAT). I have to solve a lot of CAPTCHAs, but it always
| lets me through.
| statquontrarian wrote:
| Interesting, you might be on to something! I just tried this
| and it seems to help. How does this make any sense though as I
| cleared cache/cookies and have factory settings in my other
| profile?
| sersi wrote:
| Cloudflare's verification and blocking means that I regularly
| have to use a VPN to access sites because having an HK ip address
| is reason enough to get those verifications or be outright
| blocked.
|
| In the same way that Google breaks email by blocking any small
| servers, Cloudflare breaks internet by blocking people randomly,
| not supporting firefox on linux, etc...
|
| Both are cancers that makes the world a worse place
| jmclnx wrote:
| No kidding, these days if I get prompted from cloudflare bail. I
| also noticed if using a VPN, cloudflare will block your access in
| some cases.
|
| Maybe time for a boycott of sites using cloudflare /s :)
|
| I also wonder how hart this is for people who are blind, I think
| they would have a very hard time. Seems to me blind people in the
| US could use cloudflare using the American Disability Act.
| iorrus wrote:
| I'm having the same issue using chatgpt with brave
| casenmgreen wrote:
| It's not just me then - I thought it was because I was using Tor.
|
| This is exactly the problem I face.
|
| Check -> wait -> check -> wait -> check...
| imalerba wrote:
| This is because Cloudflare is not happy with Firefox 'resist
| fingerprint' feature.
|
| Some related issues:
|
| - https://forum.gitlab.com/t/cant-open-the-signin-page-it-keep...
|
| - https://gitlab.com/librewolf-community/browser/linux/-/issue...
|
| - https://github.com/arkenfox/user.js/issues/1253
| intelVISA wrote:
| I wonder at what stage we can consider the damage Cloudflare is
| doing to the internet as naughty under anti-trust or similar?
| thdc wrote:
| The most entertaining part of when I first ran into endless
| verification loop/Cloudflare error codes is that I couldn't
| access their official forums/support articles for information
| due to the same problems.
| dijit wrote:
| Had the same issue a long time ago, it was surprising how much
| of the internet was just "turned off":
| https://blog.dijit.sh/cloudflare-is-turning-off-the-internet...
| lcnPylGDnU4H9OF wrote:
| Got SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM when I went to
| the site and a redirect to https when I manually changed the
| protocol to http. I turned off https-only mode in Firefox so
| it appears to be a redirect that your server is sending back.
|
| When I change the protocol and get the redirect back to https
| there's another "/" which is added after the domain such that
| "domain/path" becomes "domain//path". This repeats if I
| continue to change the protocol and hit the redirect such
| that "domain//path" will become "domain///path" (I noticed
| this because there was like 6 of them).
|
| Apologies if this is indeed caused by my browser settings;
| I've been unable to find the cause if that's the case.
| dijit wrote:
| The slow march of progress I suppose, that machine is
| running OpenBSD6.0 which apparently is too old for modern
| ciphers, I had A+ a year ago on Qualys.
|
| I suppose I better update it now, sorry for the
| inconvenience.
| esaym wrote:
| Yes, I was going to mention something like this. I use a custom
| firefox cookie setting and get many sites that are broken. The
| sign that it is a security setting within firefox is the fact
| that chrome will work fine.
| Tozen wrote:
| The purpose of CAPTCHA is supposedly to test if human or a bot,
| not to break or violate user privacy protections. It appears
| Cloudflare and others rather push the dangling of websites as
| "carrots", and see if they can get users to disable their ad
| blockers or any other privacy protections to get access.
|
| The Cloudflare verification has become a sick or sadistic joke
| now. It's often just used to annoy people, and no matter if
| they pass the tests, denies access anyway. If the test is not
| going to determine access, then don't provide it, and just
| wholesale be up front on mindlessly or frivolously blocking
| people and entire IP ranges.
| nine_k wrote:
| There's a natural contradiction between security and privacy.
|
| For security, an actor needs to be tested and marked as
| secure, or else tested again before every interaction.
|
| For privacy, an actor must not be marked, lest observers
| could correlate several interactions and make conclusions
| undesirable for the actor.
|
| It does not make the infinite loop produced by CLoudflare any
| more reasonable though.
| statquontrarian wrote:
| Interesting find but that's not the issue for me. about:config
| shows privacy.resistFingerprinting=false by default (maybe
| Fedora sets that default?). There were various sub-settings
| (privacy.resistFingerprinting.*), some of which default to
| true, so I explicitly set them to false, and refreshed, but
| that didn't help. I also changed layout.css.font-
| visibility.resistFingerprinting from 1 to 0. I also tried
| adding the domain I'm testing to
| privacy.resistFingerprinting.exemptedDomains and that didn't
| help.
| soco wrote:
| Lucky me, I didn't find yet any site to regret if I just give
| up when I'm presented with the "verify you're human" garbage -
| which by the way you can get also on Windows Firefox from
| Google.
| statquontrarian wrote:
| The breadth of sites that have this is increasing. I've had
| problems from everything to a website that sells eggs to
| science journals to ChatGPT.
| jeroenhd wrote:
| There's more to it than just anti-fingerprinting. There's also
| some other fingerprinting going on, and I think there may be
| some kind of IP reputation system that influences these prompts
| as well. I've put privacy protections up to max but never see
| Cloudflare prompts.
|
| I see them using some VPNs and using Tor, but that makes sense,
| because that's super close to the type of traffic that these
| filters were designed to block.
|
| I suspect people behind CGNAT and other such technologies may
| be flagged as bots because one of their peers is tainting their
| IP address' reputation, or maybe something else is going on on
| a network level (i.e. the ISP doesn't filter traffic properly
| and botnets are spoofing source IPs from within the ISPs
| network?).
| tga_d wrote:
| I'm curious why you seem to think that Tor is more legitimate
| to block than those behind CGNAT. There's been plenty of
| research showing on a per-connection basis, Tor is no more
| prone to malicious activity than connections from random IPs,
| and that it's only on a per-IP basis malicious activity is
| more likely. I.e., it's the same phenomenon as why CGNAT
| causes collateral damage. You could argue that Tor is opt-in
| and therefore less worthy of protection, but saying "users
| who want extra privacy deserve to be blocked, even when we
| know (as much as one can know) that they're not using it for
| malicious reasons" seems like a fairly dystopian premise.
|
| I'm actually kind of glad more people are becoming aware of
| this problem, and hope it finally spurs more interest in
| mechanisms that divorce network identity from IP addresses --
| including the work Cloudflare is doing on Privacy Pass!
| pixl97 wrote:
| Every IPv6 thread we get someone saying "Oh v6 is worthless,
| we can stay on v4 forever, there are no downsides to CGNAT".
| I still have no idea how they can think that.
| aaron695 wrote:
| You get with v6 it's all disposable? You can use it for 1
| min and throw it away.
|
| You'll be able to to get them from any geo-location easy as
| pie.
|
| So it's worse. You'll be even less trustworthy unless you
| register as trustworthy and keep it, which means tracking.
| The same as having a fingerprint or login now.
|
| As pro argument that sucks, it's the opposite.
| bobbylarrybobby wrote:
| So then you can build up a good reputation by sticking
| with one IPv6 address, and you shouldn't have to deal
| with any silly bot restrictions at all.
| Dylan16807 wrote:
| The second half of the address is disposable, plus a few
| more bits. The first 56 bits or so are allocated just
| like non-CGNAT IPv4 addresses are currently allocated.
| jeroenhd wrote:
| Those responses baffle me. I don't think most of those have
| ever been on the receiving end of anti-abuse features
| targeting shared IP addresses. I wonder if they're the same
| people who consider IPv4 a scarce resource that needs to be
| shared carefully.
|
| Try ten Google dorks for finding open Apache directory
| listings; your IP address gets reCAPTCHA prompts for every
| single search query for minutes. Share that IP address with
| thousands of people, and suddenly thousands of people get
| random Google/Cloudflare prompts.
| bragr wrote:
| Yeah, ever try to use Google through Tor? If you're
| lucky, it will let you do a captcha and get your result,
| but mostly it just says the IP is temporarily blocked for
| abuse.
| mrkurt wrote:
| IPv6 addresses are effectively the same as shared IPv4
| addresses in anti-abuse systems. All anti abuse systems
| treat a /48 or /56 level the same as a single IPv4
| address. It's the only way to actually detect one system
| doing abuse.
| throw0101b wrote:
| > _All anti abuse systems treat a /48 or /56 level the
| same as a single IPv4 address._
|
| With the difference being that you get your own /48 or
| /56 and suffer from only your own behaviour.
|
| If you're behind CG-NAT because your ISP can't get enough
| IPv4 addresses, then you suffer from the behaviour of
| other people.
| mixdup wrote:
| >I suspect people behind CGNAT and other such technologies
| may be flagged as bots because one of their peers is tainting
| their IP address' reputation, or maybe something else is
| going on on a network level
|
| This is a thing that is absolutely happening, I got
| temporarily shadowbanned for spam on Reddit the day I
| switched to T-Mobile Home Internet which is CGNAT'd, and I
| didn't post a single thing
| datadeft wrote:
| I seriously interested: what would happen if Firefox did allow
| fingerprinting using random() and it would generate a new
| fingerprint for each tab. Would it violate anything?
| ryandrake wrote:
| > I'm not using a VPN or Tor, just AT&T Fiber. I don't have ad-
| blockers. No weird extensions. Nothing special (besides being on
| Linux).
|
| Even if you were doing any, or all of these things, you are no
| less a legitimate internet user than anyone else. This whole
| "rain dance" supplication to show you are worthy of browsing a
| web site has got to go. Stop visiting sites who treat their users
| this badly!
| kevincox wrote:
| This reminds me of the origin of "jaywalking". People used to
| walk wherever they wanted but when cars became a thing they
| found that people where in their way. So they started to blame
| people for "jaywalking" to turn it into a bad thing that the
| pedestrians are doing rather than framing it as cars wanting to
| take some of the road away from pedestrians.
|
| We are trying to frame people who are trying to protect their
| privacy as "suspicious" rather than saying that we want to
| track them better.
| tinglymintyfrsh wrote:
| The FUD and moralization of groupthink conformance.
|
| When not in a vehicle and there are no cops around, I do the
| New Yorker thing: I completely ignore signals and focus on
| traffic. The prima facie and prime directive is safety over
| conformance. I will not waste my life at the behest of some
| Christmas lights.
| kube-system wrote:
| Likening packets on the internet to people in a street is not
| an accurate analogy. The reason people use these solutions is
| that they're inundated with garbage traffic that is often
| automated. The internet is more like a street with 5 real
| people and 1,000 malicious humanoid robots.
| ipaddr wrote:
| You get 1005 requests for a file. They are all real
| requests. You simply send back the data.
|
| You want to determine who is manually asking vs automated
| so you can ignore requests that aren't manually generated.
| Wazako wrote:
| We are more in the case of adding a turnaround on
| footpaths to block motorbikes and other 2-wheel scooters.
| captcha also exists in the real world.
| jacquesm wrote:
| If it needs a checkbox to confirm you're a human then I
| would say that's a lost battle. A bot would be just as able
| to click that as I am. And I keep being hit with these over
| and over again. It's well beyond just annoying, especially
| when it is sites that I have a long standing relationship
| with. Which I wonder: are those sites even aware that
| Cloudflare keeps popping up that check dialog?
| kube-system wrote:
| You are right that scripts can check a checkbox. Which is
| why the "checkboxes" that cloudflare/recaptcha display to
| you are not actually checkboxes. They're fingerprinting
| and behavioral analysis scripts.
| hammyhavoc wrote:
| [flagged]
| justizin wrote:
| > Stop visiting sites who treat their users this badly!
|
| The problem is the individual sites aren't making these highly
| technical decisions, people are using what seems to them an
| innocuous security product.
|
| Not visiting a random website places no pressure on CloudFlare
| to change, since there's no way to correlate your choice with
| the decision to use CloudFlare.
| tinglymintyfrsh wrote:
| It's a form of digital totalitarianism. Submit to the rule of
| a few corporations or be left out socially, economically,
| etc.
| thewebcount wrote:
| Not to mention that you may not have a choice. I've seen
| government sites have this shit on them. We're quickly
| approaching the satirical society of the movie _Brazil_.
| tinglymintyfrsh wrote:
| Unverified: 27B/6 derives from George Orwell's address.
|
| I'm wondering how long it will be before we have memory
| holes considering how, apart from the internet archive,
| there is perpetual bitrot and silent updates.
| jackmott42 wrote:
| agreed, especially when you are trying to BUY something. the
| modal popups trying to get you sign up for newsletters, the
| demand to prove you are human, fuck right off.
| tinglymintyfrsh wrote:
| _I see you 're using an ad-blocker. You must disable it to
| see my low-effort content that's available on the next search
| result._
| anonzzzies wrote:
| What is the alternative though; we had a millions of requests
| from 100000s of IPs from all continents a few months ago;
| literally the only thing that got our site back up was bot
| fight from cloudflare. How do you do this another way?
| notatoad wrote:
| there is no alternative. it sucks, and so people complain.
| the only solution is to just let people complain.
|
| there's no way to solve this problem without having some sort
| of tracking system to determine who's a legitmate user.
| xcdzvyn wrote:
| So, if somebody so wishes to take down a website they
| dislike, we should just put up with it? If a state actor
| DDoSes a journal documenting war crimes, we just ask them
| nicely to stop?
| notatoad wrote:
| that's absolutely not what i'm saying. if somebody wishes
| to take down a website they dislike, we (as website
| operators) should block their bot traffic. and we should
| use whatever reasonable methods we have to detect what
| traffic comes from bots and what traffic doesn't come
| from bots. that includes putting cloudflare in front of
| our sites.
|
| and when some legitimate users really, really look like
| bot traffic because they circumvent whatever methods we
| use to determine whether traffic is coming from real
| people, they might sometimes get blocked along with the
| bots. they're going to complain about that, and the only
| thing we can do is listen to their complaints.
| diego_sandoval wrote:
| Maybe it could get solved by paying a couple of cents to
| the website administrator, in the form of cryptocurrency,
| and in exchange you get a few dozens of requests that the
| website agrees to reply to.
| mschuster91 wrote:
| [flagged]
| statquontrarian wrote:
| Personally, I have no problem with CloudFlare or their
| verification and protection products. But something's broken
| if it works in Chrome but not in Firefox (and I'm not doing
| anything special in Firefox).
| ryan29 wrote:
| I think there are potential alternatives that could evolve.
|
| My preferred solution would be domain validated identities
| with long lived, global reputation alongside some type of
| attestation. For example, if I have a GitHub account with
| 'example.com' as a verified domain, GitHub could attest
| 'example.com seems to be a real user or organization that
| behaves well'. It would be similar to the web of trust
| concept in GPG, but technology is to the point where it could
| actually be built in a way that makes it usable. Money that
| you're spending, or the way you interact in well known
| communities, could have the side effect of bolstering your
| reputation everywhere.
|
| My most feared solution would be a similar system of
| attestation, but using Passkey since it would solidify the
| role of the current big tech companies as the arbiters of
| everything online. For example: You look
| like a bot. How do you want to prove you're human?
| Microsoft Google Apple
| Facebook
|
| Those companies, as Passkey providers, would, for all intents
| and purposes, be your 'anchor identity' online and they'd be
| in a good position to attest to you behaving like a normal,
| non nefarious participant.
|
| I think Apple would be the company that could sell that kind
| of change to normal users. It could be done in a way that's
| anonymous because all you really need is an attestation that
| says 'Apple certifies this user is in good standing'. Apple
| is very good at selling those kinds of changes as being
| privacy focused and I think their user base would go for it
| if it were framed as 'good people' (aka Apple device owners)
| getting a superior experience that isn't available to the
| 'bad people' (aka bots, bad actors, and outliers).
|
| If it worked, Google would follow with Android. Anyone else
| large enough for their opinion of you to count (Microsoft,
| Facebook, etc.) could probably compete, but it doesn't work
| for startups or small, less known providers.
|
| In my opinion, as soon as authentication moves to something
| like domains or digital signatures where 3rd party
| attestations become simple, we could see a lot of new ideas
| that focus on reputation and related solutions / services.
| thewebcount wrote:
| But I don't want any of those companies knowing which
| websites I visit. I only do business with one of them, and
| even then, they have no need to know what I'm doing outside
| of interacting with their sites. These companies have
| enough power already. Leaving it to them to decide whether
| you're trustworthy or not is just as dystopian as what's
| happening now. You've just moved the problem from
| Cloudflare to one of those companies. Plus, if they
| suddenly decide your account is invalid for some arbitrary
| reason that you aren't allowed to know, now you're
| completely fucked.
| adrr wrote:
| Curious, why do you have a bot problem?
| mikae1 wrote:
| _> Stop visiting sites who treat their users this badly!_
|
| Too bad that basically means you can't surf the internet
| anymore as a majority of websites use Cloudflare. One of my
| Firefox installations on Linux are also plagued by this. I
| can't use Firefox to browse the web.
| hinata08 wrote:
| I already do that tbh. The internet is pretty redundant and
| you can find what you want anywhere.
|
| CloudFlare blocks me from a part of the internet when I use
| anonymizing tools like Tor. I assumed they just do that to
| fingerprint and track you. Even the crypto thing to get a
| dozen or so passes after solving a riddle never worked.
|
| So I have just moved on to websites protected by Akamai, or
| virtually anything but CloudFlare. It's not just a political
| decision btw. It's just easier to move on than to try to
| fight CloudFlare or to become viral on HN to get support.
|
| It shouldn't be up to the user to adapt, but to the website.
| hn_throwaway_99 wrote:
| > This whole "rain dance" supplication to show you are worthy
| of browsing a web site has got to go.
|
| This is just whining. I don't necessarily like it either, but
| you conveniently ignore all the reasons why that rain dance
| supplication exists in the first place. All ears if you have a
| better solution for DDoS attacks, malicious bot traffic, etc.
| tinglymintyfrsh wrote:
| I get CAPTCHA fails from my work's corporate network. We are on
| VPN and it makes us look like a sketchy VPN provider. Heck,
| StackOverflow blocks us half the time without a CAPTCHA
| challenge.
| kube-system wrote:
| Why is this Cloudflare's problem to fix?
|
| If you get locked out of your hotel room, do you call Assa Abloy
| to complain?
|
| Complain to the site that their site doesn't work. They are the
| ones that install and configure their security software.
| JohnFen wrote:
| I don't know why you're getting downvoted. I think what you're
| saying makes a lot of sense.
| afandian wrote:
| Websites are generally presumed open for business, not get-a-
| contract-first like a hotel room. A better analogy would be a
| shop front with an 'open' sign in the window.
|
| An increasing numnber of shops on the street have locks that
| silently open if you look like the right kind of person, but
| lock if you don't look right.
|
| And most people look right, so they don't even realise the
| lock is there.
| kube-system wrote:
| Most websites are not clear-net. But regardless, people who
| do not fit social appearance norms are routinely not
| welcomed in businesses, often legally.
|
| Here's some real-life equivalents to a web application
| firewall:
|
| https://www.flickr.com/photos/ibran/595450232/
|
| https://www.manythings.org/signs/im/shirt_and_shoes_require
| d...
|
| https://media.istockphoto.com/photos/restaurant-dress-
| code-p...
| statquontrarian wrote:
| The analogy doesn't apply because a hotel has an override using
| a master key. In this case, the website, hopefully, would just
| open a support ticket with CloudFlare, and add a level of
| indirection that likely means my HAR file wouldn't even make it
| to CloudFlare. However, I think you make a good point that
| reporting to the website will put more pressure on CloudFlare
| or the website owner may choose a different vendor that has
| fewer problems. I think it's worth reporting to both in this
| case.
|
| Now that CloudFlare has engaged with this problem, I'll give
| them some time to try to fix it, and if they don't, I'll start
| complaining to every website that uses this CloudFlare feature.
| kube-system wrote:
| > The analogy doesn't apply because a hotel has an override
| using a master key.
|
| Website operators can override Cloudflare the same way.
|
| https://developers.cloudflare.com/waf/tools/ip-access-
| rules/...
| hinata08 wrote:
| there are countless services that do what CloudFlare is doing
|
| but not a single one has the false positive rate that
| cloudflare has
|
| cloudflare only accepts the very standart users, and locks a
| lot of others out. and then they offer no convenient way to
| prove you're a legitimate user, to access the website.
|
| and they have to fix it, because they sell their protection to
| admins who don't want to set it up themselves. They have the
| knowledge and are tasked to do that
| kube-system wrote:
| That is not at all true. Many other WAF configurations are
| much more ham-fisted. It is not uncommon for some to block
| entire countries, or block any IP ranges belonging to known
| VPNs, proxies, and Tor.
| andersa wrote:
| There is no other viable solution for hosts. Once we can finally
| have properly authenticated traffic that verifiably comes from a
| human all this nonsense with captchas can end.
| parhamn wrote:
| Adding another comment in general response to folks saying
| "spam/bots sucks, internet is broken"
|
| I get the reason for these pages. But there needs to be an escape
| hatch in there somewhere. After N cycles of poor fingerprinting,
| give me some way of asserting I'm human-ish or even slow me down
| sufficiently where bots are stifled. I'm happy to pay a tax of
| some sort as long as there is an escape hatch.
|
| As of now, the page keeps looping. For the sake of curiosity I've
| let it do it's thing for a few hours and it never stops. I'd even
| take logic games or math problem at this point if captchas are
| too easy to break. Give me an escape hatch that isn't "use
| chrome".
| johanvts wrote:
| I can't use phind on one of my machines thanks to this. It's Just
| stuck trying to load the checkbox. Windows machine.
| nicce wrote:
| It does and we can't do much but avoid using it for our services.
|
| On Firefox it hasn't worked for a long time.
| foobarian wrote:
| To be fair, this is not breaking the "internet," it is just
| breaking access to a subset of popular "websites" which are free
| to choose this. The Internet itself is much more than this in
| quality, if not quantity.
| statquontrarian wrote:
| The breadth of this impact has surprised me and it's clearly
| growing. Whether CloudFlare or other services perform this
| verification, I think it's important to highlight the lack of
| community support which is what really bothers me. It's fine
| for them to add reasonable protections for their customers, but
| they are not working with the community to reduce false
| positives.
| LWIRVoltage wrote:
| I noticed, when you browse with Linux or a VPN and sites go
| crazy- that HCaptcha seems far friendlier than Recaptcha in that
| i never get stuck in a loop like Recaptcha does where it glitches
| out, or bugs out and makes it so you'll spend 5+ minutes going
| through 5 or 6 rounds of matching images because it oddly fails.
|
| If captchas are so important - serious point, perhaps different
| ones are the way to go?
|
| I apologize in advance if this is more of a setting of difficulty
| from Cloudflare on Recaptcha, and Hcaptcha potentially being able
| to be set just as difficult/cost you as much time to get past/etc
| duskwuff wrote:
| > bugs out and makes it so you'll spend 5+ minutes going
| through 5 or 6 rounds of matching images because it oddly
| fails.
|
| That isn't just a reCaptcha thing. HCaptcha will definitely do
| that as well -- and if anything it's worse, because some of the
| "identify this AI-generated image" challenges are pretty awful.
| (At one point, I recall it asking me to "select the ladybugs"
| with nine images all containing round spotted bugs in slightly
| different shades of red and orange.)
| clowd wrote:
| Yes, this is annoying as hell. It's gotten to the point where I
| just close out of a site when I see that interstitial come up.
| IYasha wrote:
| yeah, same here. ( for example, I can't access forum.xda-
| developers.com anymore.
| mikequinlan wrote:
| If you can't pass the captcha test, you need to ask yourself: Are
| you really a human being, or have you just been programed to
| believe that you are?
| iFire wrote:
| I am going to presume that CloudFlare wants an id on the person
| or it rejects the request. Even through vpns.
| sph wrote:
| I'm working on a crawler and CloudFlare is the cause of 99% of
| all the headaches and random bugs I encounter doing simple HTTP
| requests.
|
| I literally have implemented custom logic to deal with sites
| returning the "Server: Cloudflare" header.
| smcleod wrote:
| I find it less annoying than having to fill out captchas - but
| yes - it's annoying and it makes me not want to visit the
| website.
| r721 wrote:
| How is it less annoying when you can't visit the website in the
| end? Sometimes the loop is literally infinite - you can click
| those buttons for hours without any success.
| orthecreedence wrote:
| > Tell HN: Cloudflare is breaking the internet
|
| Fixed that for you. Cloudflare is a dark force of centralization
| operating under the threat of "but what if my forum with 10 users
| gets DDoSed?!" or "I'm too busy to set up Let's Encrypt so I let
| some random third party who leaks secrets all over the open
| internet terminate TLS on my behalf."
|
| And bonus now we all have to jump through 15 captcha hoops to
| load some stupid website barely worth visiting anyway. Who gives
| a flying fuck if bots look at your ugly website anyway?
| bearjaws wrote:
| ... I don't think people are using cloudflare to protect
| something willy nilly.
|
| My general experience is, if you host a popular site, it will
| be DDOS'd.
|
| If you host a site in a 'competitive' space, you will get
| DDOS'd.
|
| I've seen it all personally, forums, image upload sites, NFT
| galleries, and SAAS health tech even, people will spend a
| couple hundred dollars to make you miserable.
|
| If you don't have protection, they can literally see how you
| are falling and it only encourages further spend.
| evilspammer wrote:
| Worth mentioning that Cloudflare also hosts those DDOS
| services and prevents them from being shut down.
| lwansbrough wrote:
| I really hope Privacy Pass Device Attestation can solve this once
| and for all.
| modzu wrote:
| you're using linux.. you baddie
|
| look theres lots of linux bots. and theres just no efficient way
| to really tell em apart from humans on linux. thats fine right?
| sort of like when the cops pull over a black dude
| pierat wrote:
| Even though they will engage on _your_ ticket, the problem is a
| business level problem they help create and solve at the same
| time.
|
| https://rasbora.dev/blog/I-ran-the-worlds-largest-ddos-for-h...
|
| It was also discussed previously via
| https://news.ycombinator.com/item?id=32709329
|
| > "Without CloudFlare's "neutral" security service offerings I
| couldn't have facilitated millions of DDoS attacks."
|
| For those of you who are blaming website operators;
|
| > "As someone who has previously justified their actions by
| saying "I am not directly causing harm, the responsibility flows
| downstream to my end users" I can tell you it is a shaky defense
| at best. "
|
| The crux of the issue is this:
|
| > "CloudFlare is a fire department that prides itself on putting
| out fires at any house regardless of the individual that lives
| there, what they forget to mention is they are actively lighting
| these fires and making money by putting them out!"
|
| The crooks and the ilk of the internet get a free ride to do
| their 'shark infestations' everywhere online thanks to CF.
| However the real humans are the ones harmed here. One person
| complaining loudly got a ticket addressed. The other 10000
| affected won't.
| bironran wrote:
| - https://www.google.com/search?q=%22is+breaking+the+internet%22
| " Tell HN: Cloudflare verification is breaking the internet "
| - https://www.google.com/search?q=%22is+breaking+the+internet%22&
| tbs=cdr%3A1%2Ccd_min%3A2021%2Ccd_max%3A2022&tbm= " Why
| Billie Eilish is breaking the internet ? " - https://www.go
| ogle.com/search?q=%22is+breaking+the+internet%22&tbs=cdr%3A1%2Ccd
| _min%3A2020%2Ccd_max%3A2021&tbm= " The coronavirus pandemic
| is breaking the internet " - https://www.google.com/search?
| q=%22is+breaking+the+internet%22&tbs=cdr%3A1%2Ccd_min%3A2019%2Ccd
| _max%3A2020&tbm= " This Basic Math Problem Is Breaking the
| Internet "
|
| ...
|
| And yet, miraculously, the internet seem to have survived. It has
| even survived underwater cable cuts, DNS black holes rouge
| countries and plain stupid BGP by plainly stupid admins,
| firewalls - great and less-than-great ones, internal networks
| with more or less surveillance, more or less hostility towards
| VPNs, TOR and other anonymizing services.
|
| Cloudflare is large, yet it's not "the Internet". Firefox
| community is also large, yet there are other browsers and tools
| to browse "the Internet".
|
| I wish "breaking the internet" would stop being thrown around in
| such a cavalier manner. </rant>
| benlivengood wrote:
| Put blame where blame is due. Poor security practices in
| operating systems of Internet-connected devices are breaking the
| Internet. Bandwidth is not cheap and only botnets can afford to
| DDoS major Internet sites. Cloudflare is the mitigation to
| terrible security practices in software development and system
| administration that allows botnets to persist. Cloudflare is
| simply the Schelling point people have arrived at to minimize
| harm until we have better-secured peers on the Internet (if
| ever).
|
| The incentives are unfortunate; bandwidth is not free but it's
| cheap enough that individual owners don't really care if their
| hosts are part of a botnet until their ISP starts complaining or
| disconnects them. Individuals also don't really have good choices
| available to them; consumer devices rarely get patched for very
| long compared to their useful lifetime.
|
| I think the current compromise is better than some alternatives
| like an Internet Passport or harsh penalties for making mistakes
| on the Internet or FDA/FCC levels of scrutiny on Internet-
| connected devices.
| tinglymintyfrsh wrote:
| Fastly's CAPTCHAs refuse to accept from my work's network.
| hammyhavoc wrote:
| Use Privacy Pass then if you don't want to use Chrome.
| https://privacypass.github.io/
| hinata08 wrote:
| it never worked on my tor browser
| Hizonner wrote:
| That still forces you to go and proactively solve a ton of
| CAPTCHAs to get points or tokens or whatever it calls them. And
| some things seem to be just plain irretrievably broken
| regardless, whether by Cloudflare or by the clients I can't
| say.
| hammyhavoc wrote:
| You can't have it both ways.
|
| People use CloudFlare to solve a multitude of problems, some
| of which include automated attacks by bots, which would make
| the website unavailable in the first place.
|
| If you're going to use a non-mainstream browser then you're
| going to compromise in some way. If people are going to
| defend their website against attackers then there's
| compromise.
|
| CloudFlare isn't the problem, it's a symptom of other
| problems left unsolved. Is it a compromise? Yup. What's the
| alternative? Not using it and thus having constant downtime?
| clowd wrote:
| If Cloudflare has decided that Firefox is a "non-mainstream
| browser" and is applying a penalty to its users, then
| Cloudflare is the problem.
| hammyhavoc wrote:
| The end user chose to use Firefox. The service provider
| is free to do as they please, it's their infrastructure
| and your access to it is at their discretion.
|
| Don't like it? Use Privacy Pass or pick another set of
| compromises.
|
| With that said, when I was still willing to subject
| myself to Mozilla in any form, I never found CloudFlare
| to be a problem, and I've used it since it launched. If
| people use Firefox, they're probably a privacy wonk
| LARPing an imagined threat model, and are using a shitty
| cheap VPN used by countless attackers, it's unlikely to
| be the browser itself unless they're doing something
| weird with extensions.
| JohnFen wrote:
| > Don't like it? Use Privacy Pass or pick another set of
| compromises
|
| Nah. I'll just not use the website. They obviously don't
| want me there anyway.
| jeroenhd wrote:
| I've done this, with CAPTCHA screens and advertiser-
| induced cookie stalking. The worst offenders end up in
| PiHole.
|
| I'm sure nobody cares about my blocks, but we've got to
| start somewhere if we want websites to change their
| behaviour.
| hammyhavoc wrote:
| And yet only the other day you posted a link to a site
| behind CloudFlare:
| https://news.ycombinator.com/item?id=35643933
|
| I'm confident you use CloudFlare every day, many times
| per day.
| JohnFen wrote:
| I'm sure I do. What I meant was that when I hit a snag
| with a captcha, I'll just move on. I'm not going to
| wrestle with it. I can take a hint.
| Hizonner wrote:
| Using a "non-mainstream browser" is not in fact an
| indicator of malicious or even "annoying" behavior. It's
| almost certainly not even statistically associated. In
| fact, if you're going to build a bot that impersonates a
| browser, the natural choice right now is to impersonate
| Chrome. And there are frameworks available for puppeting
| Chrome.
|
| What they seem to be doing is just presenting a CAPTCHA to
| anything at all unusual. Which is actually kind of strange,
| given the vast amount of raw data available to them. They
| should be able to learn _real_ indicators.
|
| I'm actually not even sure Cloudflare is primarily
| responsible for most of this... exactly. The problem is
| more likely that Cloudflare gives its users a lot of knobs
| to twiddle, and most of the users are probably not up to
| twiddling them correctly. That could be the main source of
| these problems.
|
| And there are so many possible combinations that it would
| be hard for Cloudflare to really test them, or even think
| about how all the knobs might interact.
|
| Taking away knobs would be a good start, but there may be
| reasons they don't think they can do that. Probably reasons
| that are more about their customers' perceptions than about
| their customer's real needs.
|
| Come to think of it, isn't one of those knobs the ability
| to turn off PrivacyPass? I don't have access to a
| Cloudflare account at the moment, but I seem to remember
| that it was.
| Sohcahtoa82 wrote:
| > Using a "non-mainstream browser" is not in fact an
| indicator of malicious or even "annoying" behavior. It's
| almost certainly not even statistically associated. In
| fact, if you're going to build a bot that impersonates a
| browser, the natural choice right now is to impersonate
| Chrome
|
| This is a good point.
|
| Bots are going to try to make their traffic look as legit
| as possible, which means spoofing the most common
| browsers with the most common setups.
|
| So if a User-Agent is reporting that it's running
| Firefox, it's actually more likely that it's legit
| traffic, as bots wouldn't try to pretend to be an
| uncommon setup.
| hammyhavoc wrote:
| It isn't a good point though. The problem isn't that a
| user might be malicious because they are or are not
| running Chrome, the problem is that you chose Firefox and
| that comes with compromises, just like picking Chrome
| comes with compromises.
|
| The "non-mainstream browser" comment is about zigging
| when the overwhelming majority of people zag. It's a
| self-inflicted problem.
|
| Don't like it? Pick a different set of compromises,
| whether that's using Privacy Pass or a Chromium-
| derivative browser. God forbid people work on the problem
| itself rather than just complain that they don't like
| compromising.
|
| You can't demand "taking away knobs" with taking away
| control of the end user on CloudFlare whilst
| simultaneously lamenting that using Firefox (browser
| choice is a "knob") yields compromises. It's
| hypocritical.
|
| Why shouldn't people be free to deny Tor users access to
| their server? Why shouldn't people be free to self-
| inflict their set of compromises on themselves with their
| choice of browser? Why shouldn't people be free to
| mitigate bruteforce attacks? It may not align with your
| views or beliefs, but that service provider is free to do
| as they please within the extent of the law. Doesn't make
| it ethical, but your access to the service depends on x.
|
| Life is compromise.
| jeroenhd wrote:
| > Using a "non-mainstream browser" is not in fact an
| indicator of malicious or even "annoying" behavior. It's
| almost certainly not even statistically associated. In
| fact, if you're going to build a bot that impersonates a
| browser, the natural choice right now is to impersonate
| Chrome. And there are frameworks available for puppeting
| Chrome.
|
| It definitely is. And there are even bot detection
| services that can detect puppeted Chrome installs pretty
| reliably (I ran into that when I tried to scrape some
| data about the housing market). Blink, WebKit, and Gecko
| are the only common browsers and the rest is a long tail.
| If you pick an uncommon browser (Lynx, Ladybird) you're
| an outlier in most automated scans but still end up with
| a smaller total browser market share than even the small
| bots. Another reason to be suspicious of uncommon clients
| is that puppeted Chromium builds with special flags to
| prevent bot detection don't run on a hacked security
| camera/router/TV box/NAS/IoT box.
|
| If you're being extorted by someone who paid $50 to DDoS
| your business for a month, you're going to turn up the
| DDoS protection knobs. The annoying tracking,
| cyberstalking and CAPTCHA services are mere symptoms of
| the underlying problem.
|
| I wouldn't want to use an internet where Cloudflare
| doesn't give you knobs to turn. You'll end up with
| websites either not being protected from DDoS attacks or
| several layers of CAPTCHAs for everyone. Sometimes you
| need to turn up the protections when the defaults don't
| work well enough but the defaults shouldn't be high
| enough to cover those scenarios.
| Hizonner wrote:
| > It definitely is.
|
| Is an independent indicator, or is statistically
| correlated?
|
| > And there are even bot detection services that can
| detect puppeted Chrome installs pretty reliably (I ran
| into that when I tried to scrape some data about the
| housing market).
|
| Interesting. The arms race continues...
|
| > Blink, WebKit, and Gecko are the only common browsers
| and the rest is a long tail. If you pick an uncommon
| browser (Lynx, Ladybird) you're an outlier in most
| automated scans but still end up with a smaller total
| browser market share than even the small bots
|
| The post I was responding to was calling Firefox an
| "uncommon browser".
|
| > If you're being extorted by someone who paid $50 to
| DDoS your business for a month, you're going to turn up
| the DDoS protection knobs. The annoying tracking,
| cyberstalking and CAPTCHA services are mere symptoms of
| the underlying problem.
|
| Wouldn't most Cloudflare users prefer that Cloudflare
| notice that attack, adjust the settings by itself, and
| send them an email saying "You appear to be under attack;
| we've enabled X, and lowered the thresholds for Y and Z"?
| And then notice when the attack seemed to be slowing
| down, and put things back the way they were?
|
| I'm normally not a fan of machines acting like they know
| better than I do... but the machines probably _do_ know
| better than Cloudflare 's average customer.
|
| At the very least, they could probably find ways to
| discourage people from messing with knobs they don't
| understand, and more ways to make the specific costs
| obvious, even if those knobs ultimately stayed available.
| IYasha wrote:
| It's not a matter of "why" it's a matter of "how".
| Cloudflare could have done way less intrusive and nerve-
| wrecking DDoS protection. But no, they had to make people
| suffer.
|
| Also, I'm using Falkon browser every day - ever heard of
| that? I have to switch user agent to be allowed in some
| places which is ridiculous.
| MichaelZuo wrote:
| Can you think of a feasible alternative?
| IYasha wrote:
| Why not just "enter grainy distorted 123 + 456"? No JS,
| no tracking. It takes literally milliseconds to generate
| and present. I've seen this work on large scale. Why is
| it mandatory to run tons of JS anyway?
|
| It may be profitable to use CAPTCHA for AI training, but
| that's not only annoying, it's also unethical because one
| (like me) may be unwilling to engage in such activity.
| Also, CAPTCHAs involving houses, number plates or bikes
| are absolutely invading someone's privacy.
|
| Owners of websites (e.g. shops) themselves have more
| options to show captchas only in critical moments: when
| performing heavy searches, registering, checking out,
| posting. Again, it doesn't have to be intrusive or
| disruptive. But I understand this way takes more
| professional approach and probably requires programming,
| which is not what _every_ store owner can probably
| afford.
| MichaelZuo wrote:
| > Why not just "enter grainy distorted 123 + 456"? No JS,
| no tracking. It takes literally milliseconds to generate
| and present. I've seen this work on large scale. Why is
| it mandatory to run tons of JS anyway?
|
| Probably because it takes fractions of a cent to solve
| those grainy distorted captchas?
|
| Whereas its not so trivial to get an extra IP address,
| extra computer, etc.
|
| I can't think of any alternative that would still be as
| onerous a bar to spammers and bots but also be less
| restrictive for genuine users. Other then linking real
| IDs, which has its own can of worms.
| IYasha wrote:
| I have to emphasize here that I don't mean to throw away
| DDNS/multi-gateway protection, just criticizing the user
| interaction.
| IYasha wrote:
| And what if I have to use 3 browsers and don't want to set up
| accounts or give up privacy?
| hammyhavoc wrote:
| Then that's your own prerogative.
| spxd wrote:
| I'm using only FF on Ubuntu and Win10. Sometimes I receive the
| Verify window (2x per week) mostly on Win10. I'm from Europe.
| This started less than a month ago.
| justsomehnguy wrote:
| > I finally went and deleted all my cookies and cache which I had
| been dreading to do.
|
| You could had just try it in the porn mode. Another option is to
| use a different profile or a portable version.
|
| https://support.mozilla.org/en-US/kb/profile-manager-create-...
|
| https://portableapps.com/apps/internet/firefox_portable (Windows
| only, I guess)
| statquontrarian wrote:
| I just tried creating another profile and it seems to help! I
| didn't realize clearing cache/cookies might be insufficient.
| Maybe it's some other setting that I have in my default
| profile, although I don't remember changing much at all from
| factory Firefox settings.
| justsomehnguy wrote:
| Glad to hear!
|
| There are some things around local storage which isn't cleard
| even if you clear cookies.
| causality0 wrote:
| I have become quite tired of disabling my VPN extension every
| time I visit a Cloudflare site. If I don't it just reloads the
| verification page over and over.
| danwee wrote:
| Even if the loop is just one iteration, it's already breaking the
| internet. I cannot stand web sites that show the CloudFlare
| verification page before you can access. It's just ridiculous.
| passion__desire wrote:
| Isn't this for stopping DDoS?
| MatthiasPortzel wrote:
| No. Cloudflare offers different levels of protection. One
| level is 'prevent DDoS.' Another level is 'prevent bots from
| accessing the site at all.' Not all bots are part of a DDoS.
| The problem is that many website owners turn on the second
| setting, because 'bots are bad,' without realizing that this
| means that some of their users are going to have to fill out
| Captchas.
|
| (Comment written from memory, I may have details wrong.)
| marginalia_nu wrote:
| Sometimes it's a lesser evil. Clouflare blocks about 1.6
| million bot search queries per day on my search engine.
| Simply could not operate it without this inconvenience.
| KomoD wrote:
| 1.6 million out of how many total?
| marginalia_nu wrote:
| 50k legitimate queries / day on a slow day. A HN hug of
| death is maybe 100-150k/day.
| yamtaddle wrote:
| I think those who haven't operated a publicly-visible
| server on the open Internet in some time might be
| surprised at just how shark-infested these waters are
| now. It's, like, _mostly_ sharks.
| bombcar wrote:
| That's what it is for, but most setups don't have it setup
| correct (the verification page should ONLY appear during an
| actual DDoS, and even then only against IPs that appear to be
| participating).
|
| It wants to do a bit of cryptography, which means that if
| scripts/WASM/etc are disabled, you can be out of luck.
| statquontrarian wrote:
| I have noticed my CPU spike during these checks; however, I
| have factory settings for Firefox and haven't disabled
| scripts/WASM/etc. Is there some setting that Firefox might
| default to that could cause this?
| bombcar wrote:
| No idea as I use brave, but check the console log for
| blocking or anything like that.
| sn41 wrote:
| Yes, but aren't there more viable options? Like: a transition
| page that just waits for 5 seconds before loading. Then I
| don't have to, as an Asian, wonder how American school buses
| look like when I "click on all squares that have a bus". As
| though stop signs, buses and yachts are somehow universally
| the same all over the world.
|
| CAPCHA/RECAPCHA is the internet version of the infamous
| "regatta" question on SAT [1].
|
| [1] https://www.clearchoiceprep.com/sat-act-prep-blog/the-
| most-i...
| IYasha wrote:
| The page sometimes keeps refreshing literally forever.
| Completely ignoring my unconfirmed "Allow this page to reload?"
| prompt. I left it "checking" for hours once. No luck.
| mindslight wrote:
| But you know the website might have sooper sekret information
| they want to protect, which is why it's been published on a
| public website.
|
| Speaking of bullshit restrictions designed to encourage
| compliance with surveillance, have imgur links just straight up
| stopped working for anyone else recently? I'm coming from a
| datacenter IP. I assume it's just some heavy handed part of the
| cost cutting push they announced.
| halfjoking wrote:
| Imgur links haven't worked on my VPN for a long time.
|
| Even if they did, I'd still avoid imgur since they censor
| even worse than reddit.
| hammyhavoc wrote:
| CloudFlare is usually there to mitigate bots attacking.
| Without which, the site wouldn't be available to view in the
| first place.
|
| CloudFlare is merely the symptom of a greater set of
| problems, which it attempts to mitigate.
|
| If you want to be angry about something, be angry that
| bruteforce attacks are common, guzzle resources and usually
| yield zero legal repercussions in most cases.
| statquontrarian wrote:
| Personally, I have no problem with CloudFlare's bot
| protection. My problem is with CloudFlare's lack of
| diagnostics and community involvement to resolve/explain
| false positives. I have no idea what obscure default
| setting to change in Firefox to make it work.
| slig wrote:
| [deleted]
| hammyhavoc wrote:
| Perhaps. Ask your government about it if you genuinely
| don't think the alternative is going to be far worse.
| People demand x solutions for y technologies like crypto
| or AI. Demand solutions for the problem.
|
| The centralized solution is going to be a government-
| owned/controlled MITM service like CloudFlare. No doubt
| with actual ID for verification.
|
| I don't see the decentralized solution happening any time
| soon.
|
| Massive attacks existed long before CloudFlare ever did.
| If you're implying there's a conspiracy that CloudFlare
| is attacking others directly or indirectly to sell their
| solutions, I'd be extremely careful as that's defamatory
| and almost certainly false.
|
| Furthermore, most CloudFlare users only use the free plan
| and thus cost CloudFlare money. Isn't that curious?
| [deleted]
| Alupis wrote:
| Verification isn't about keeping secrets, obviously, it's
| about restricting the velocity of bots and their ability
| (intentional or not) to degrade your site's
| performance/availability.
|
| There are too many bots out there that are very inconsiderate
| and do not limit or throttle themselves.
|
| We have one right now that crawls every single webpage (and
| we have 10's of thousands) every couple days, without any
| throttle or limit. It's likely somebody's toy scraper, and
| currently it's doing no harm, but not everyone has the server
| resources we have.
|
| The point is - if you are dealing with inconsiderate bots, a
| captcha of some type is pretty nearly a bullet proof way to
| stop them.
|
| With that said, Cloudflare usually is smart enough to detect
| unusual patterns, and present a challenge to only those who
| they believe are bots or up to no good. If every person gets
| a challenge, then the website operator is either experiencing
| an active attack, or has accidentally set their security
| configuration too high.
| mindslight wrote:
| I do know the common narrative. FUD -> more snake oil
| "solutions". I myself rely on a special type of igneous
| rock that keeps hackers away. In reality:
|
| 1. Most sites only have this problem due to inefficient
| design. You are literally complaining about handling 1
| request every 2 seconds! That's like a "C10m problem."
|
| 2. How many IPs are these bots coming from? Rate limiting
| per source IP wouldn't be nearly as intrusive.
|
| 3. There are much less obtrusive ways of imposing resource
| requirements on a requester, like say a computational
| challenge.
| Alupis wrote:
| Not every website is the same, folks.
|
| > You are literally complaining about handling 1 request
| every 2 seconds
|
| I don't know where this came from. The inconsiderate bots
| tend to flood your server, likely someone doing some sort
| of naive parallel crawl. Not every website has a full-
| stack in-house team behind it to implement custom server-
| side throttles and what-not either.
|
| However, like I mentioned already, if every single
| visitor is getting the challenge, then either the site is
| experiencing an attack right now, or the operator has the
| security settings set too high. Some commonly-targeted
| websites seem to keep security settings high even when
| not actively experiencing an attack. To those operators,
| remaining online is more important than slightly annoying
| some small subset of visitors 1 time.
| mindslight wrote:
| > _crawls every single webpage (and we have 10 's of
| thousands) every couple days_
|
| 100,000 / (86400 * 2) = 0.58 req/sec.
|
| I acknowledge that those requests are likely bursty, but
| you were complaining as if the total amount was the
| problem. If the instantaneous request rate is the actual
| problem, you should be able to throttle on that, no?
|
| I can totally believe your site has a bunch of accidental
| complexity that is harder to fix than just pragmatically
| hassling users. But it'd be better for everyone if this
| were acknowledged explicitly rather than talked about as
| an inescapable facet of the web.
| Alupis wrote:
| > But if the instantaneous request rate is the problem,
| you should be able to filter on that, no?
|
| Again, not every website is the same, and not every
| website has a huge team behind it to deal with this
| stuff. Spending 30-something developer hours implementing
| custom rate limiting and throttling, distributed caching,
| gateways, etc is absurd for probably 99% of websites.
|
| You can pay Cloudflare $0.00 and get good enough
| protection without spending a second thinking about the
| problem. That is why you see it commonly...
|
| If your website does not directly generate money for you
| or your business, then sinking a bunch of resources into
| it is silly. You will likely never experience this sort
| of challenge on an ecommerce site, for instance... but a
| blog or forum? Absolutely.
| mindslight wrote:
| Actually I get hassled all the time on various ecommerce
| sites. Because once centralizing entities make an easy to
| check "even moar security" box, people tend to check it
| lest they get blamed for not doing so. And then it gets
| stuck on since the legitimate users that closed the page
| out of frustration surely get counted in the "attackers
| protected against" metric!
|
| I'd say you're really discounting the amount of hassle
| people get from these challenges. Some sites hassle users
| every visit. Some hassle users every few pages. Some
| hassle logged in users. Some just go into loops (as in
| OP). Some don't even pop up a challenge and straight up
| deny based on IP address!
|
| And since we're talking about abstract design, why can't
| Cloudflare et al change their implementations to throttle
| based on individual IPs, rather than blanket
| discriminating against more secure users? Maybe you
| personally have taken the best option available to you.
| But that doesn't imply the larger dynamic is justifiable.
| Alupis wrote:
| > why can't Cloudflare et al change their implementations
| to throttle based on individual IPs, rather than blanket
| discriminating against more secure users
|
| Cloudflare does not do this - I've made that point
| several times. The website operator either has the
| security setting cranked to a paranoid level (which is
| not the default, btw), or they are experiencing an
| attack. Those are the only two scenarios where Cloudflare
| is going to inject a challenge as frequently as you
| assert.
|
| Normally Cloudflare will only challenge after unusual
| behavior has been detected, such as inhuman numbers of
| page requests within a short duration, or the URL/forms
| are being manipulated, etc. The default settings are
| fairly unobtrusive in my experience.
|
| If you are also complaining about generic captchas on
| forms and what-not, that's a different thing entirely.
| Those exists as anti-bot measures, naturally, but also as
| anti-human measures. We simply do not want a pissed
| customer to send us 900 contact-us form requests one
| drunken evening...
| mindslight wrote:
| > _Cloudflare does not do this - I 've made that point
| several times. The website operator either has the
| security setting cranked to a paranoid level_
|
| This is a bit of intent laundering. By Cloudflare
| providing ridiculous options, some people are going to
| take it because more "security" must be better.
|
| > _Normally Cloudflare will only challenge after unusual
| behavior has been detected, such as ..._
|
| or people using more secure browsers like Firefox with
| resistFingerprinting = 1. I suspect this is a significant
| blind spot for site operators. Have you personally tried
| your own site with RFP=1, TOR browser bundle, VPN from a
| datacenter IP, etc?
|
| > _generic captchas on forms ... exists as anti-bot
| measures, naturally, but also as anti-human measures. We
| simply do not want a pissed customer to send us 900
| contact-us form requests one drunken evening_
|
| My whole point is it's a bit disingenuous to throw out
| large quantities of things as the argument, when the
| hassles are often thrown up on the very first request.
| I'm not complaining about the sites that throw up
| CAPTCHAs after the third failed login, but rather the
| ones that do it on the first attempt!
|
| And sure, I don't have a good map of which types of
| hassles are specifically Cloudflare versus others of
| their ilk. And I certainly don't know how often
| Cloudflare _doesn 't_ cause problems, as it doesn't stand
| out. I just know there is too much indefensible
| surveillance-based user-hassling in general and OP's
| anecdote is right in line with my standard browsing
| experience on many sites these days.
| Alupis wrote:
| > or people using more secure browsers like Firefox with
| resistFingerprinting = 1. I suspect this is a significant
| blind spot for site operators. Have you personally tried
| your own site with RFP=1
|
| Yes, and it is not an issue for us. Again, this is up to
| site operators to decide for themselves. The defaults are
| sane, and Cloudflare makes it very clear what each level
| of their security configuration does. It is up to the
| site operator to decide how they want their site to
| behave. Perhaps, simply avoid sites that bother you? That
| list will grow by the day, unfortunately.
|
| > TOR browser bundle, VPN from a datacenter IP, etc
|
| Nobody, and I mean _nobody_ , cares about this traffic.
| We're in the ecommerce space, so perhaps by that I mean
| nobody in the ecommerce space cares. We do not want TOR
| traffic. We do not want random-cloud-ip-vpn traffic.
| These are more often than not where our fraud
| bots/attempts originate, and we are not alone.
|
| Recognize, if you are using TOR, or browsing regularly
| via a datacenter IP VPN - you are in an extreme minority
| and unfortunately lots of folks before you have used
| these services for bad things.
|
| I personally like TOR, and VPNs. This is no slight
| against them - but the facts are undeniable here.
|
| > surveillance-based user-hassling
|
| You also referenced canvas-based fingerprinting, and seem
| to assume that's how these things work. Some might, but
| many are much more dumb than that. Usage-pattern based
| challenges are fairly simple when you understand what
| normal traffic looks like.
| hermanradtke wrote:
| They may recrawl every 2 days and make 100,000 parallel
| requests.
| IYasha wrote:
| In my experience, if bots start flooding a server, it's
| the ISP/hosting provider that gets angry and contacts the
| owner first. )
| Hizonner wrote:
| > The point is - if you are dealing with inconsiderate
| bots, a captcha of some type is pretty nearly a bullet
| proof way to stop them.
|
| Not any more.
| Alupis wrote:
| Most bots do not handle javascript, still to this day.
| They want to scrape HTML and catalog prices, etc.
|
| At least in our experience.
| Hizonner wrote:
| OK, fair enough. Not in about six months to a year.
| Because publicly available ML can now solve pretty much
| any CAPTCHA a human can solve, there's now an incentive
| to start deploying and improving the already existing
| JavaScript-capable bot frameworks.
| Alupis wrote:
| Most bots are either search engines (of all kinds, not
| just your google's and bing's), competitors, or
| academic/fun projects.
|
| Of the three common types, only one has a serious
| interest in breaking captcha's - but they also have a
| serious interest in not getting too much attention by
| abusing your services deliberately. ie. if a bot is
| misbehaving, it's going to get our attention, and we're
| going to look into what it's doing, where it came from,
| who operates it, etc, and possibly take some action if
| appropriate or available. Those actions may not
| necessarily be limited to the technical space either...
|
| This is just our experience. Other industries will have
| their own sets of challenges to deal with.
| butz wrote:
| This is even worse for RSS. Website admin enables Cloudflare for
| DDoS protection, and RSS clients start getting errors, because
| they cannot prove their humanity. Would be great if some
| workaround would be built into Cloudflare, as contacting website
| admin probably won't do any good.
| dethos wrote:
| This is, in fact, a problematic case. RSS is expected to be
| consumed by other applications and bots. To make things worse,
| it might not be immediately obvious to the site owner when CF
| is interfering with the access to his content.
| andersa wrote:
| Website admin can solve this and still have protection by
| enabling caching of the rss feed, using a transform rule to
| drop all fields that could mess with the cache key, and then
| reducing the security level for that url. The cache works fine
| as a DDoS defense aswell as long as you don't let people mess
| with the key.
| Mindless2112 wrote:
| I've had this happen to me. I ended up configuring a proxy feed
| in Feedburner.
| lordofgibbons wrote:
| There are entire websites that simply will not work for me on
| Linux+Firefox because of Cloudflare. Never before have I wished
| for a company to go out of business, until now.
| warrenm wrote:
| CloudFlare's been "breaking the internet" for years
| kevincox wrote:
| My favourite is how depending on what hosting provider you use
| you can't access their own blog's feed. You get a 403 because
| you are a robot. Imagine that! A robot accessing a machine-
| readable feed so that humans can read your marketing material!
| How awful!
| berkle4455 wrote:
| Cloudfare gets paid when they can deliver session traffic to
| their clients that A) uniquely identifies users and B) has all
| the traffic decrypted.
|
| If you can't meet A&B they don't want you traversing their
| network.
| statquontrarian wrote:
| I'm not actively trying to avoid detection (e.g. VPN, Tor,
| etc.). Another user mentioned Firefox's
| privacy.resistFingerprinting might be the issue, but I don't
| have that enabled. Maybe there's something else in Firefox that
| is avoiding (A), and I'm willing to open a Firefox bug report
| to investigate that, but the core issue here is CloudFlare
| blocks without any diagnostic information and its community
| support forum didn't engage. This HN post has caused some
| amount of engagement from CloudFlare and hopefully it'll be
| fixed.
| jgrahamc wrote:
| You can email me (jgc@cloudflare.com) the HAR file and I'll get
| people to look at it.
| statquontrarian wrote:
| Thank you very much! Email sent at 11:38 CT although it's 1.5MB
| so check your spam.
| jgrahamc wrote:
| I have received it, spoken to the team and they are looking
| at it.
| statquontrarian wrote:
| I very much appreciate your help and I'm glad to do any
| other diagnostics. However, respectfully, I think the
| deeper issue is the lack of community support. On the
| verification page, there is no "help" button. Even with my
| motivation to find the community support page (which is
| also non-trivial), there was no response on my original
| community post and it was auto-closed which was
| particularly offensive to me (at least just keep it open).
| In my opinion, something of the magnitude of "we're
| possibly going to lock people out of large parts of the
| internet" deserves more careful engagement with the public.
|
| I also understand Linux is an obscure use case but I do
| wonder how many other "normal" use cases out there have
| been ensnared. Given the lack of a "help" link on the
| verification page, an average user is powerless.
| jgrahamc wrote:
| I'm chatting with folks about how the community stuff is
| being handled. Linux isn't obscure (it's widely used
| internally, too!).
| doublerabbit wrote:
| And in a days time this thread will be off the main page
| and nothing will of been done.
|
| Hows the "chatting" going?
| statquontrarian wrote:
| No news yet; however, one of the other HN comments
| suggested creating a new Firefox profile using
| about:profiles and that seems to have worked (whereas
| clearing cache/cookies didn't work), although I'm still
| trying to find the root cause because it's going to be
| annoying migrating to the new profile. I think the deeper
| issue stands that the process to find the cause of why
| CloudFlare is blocking large parts of the internet for me
| is too opaque, so I hope CloudFlare has a broader
| solution such as a diagnostic code or detailed help page.
|
| Right now I'm reviewing about:config for non-standard
| settings. I did find that I did set
| general.useragent.override at some point and I forgot
| about it; however, unsetting it didn't help. I went
| through all other non-default settings and haven't found
| anything yet.
| bmilleare wrote:
| I also hit the CloudFlare verification merry-go-round several
| times per day using Ubuntu / Chrome.
| karaterobot wrote:
| I assumed it was due to me being on a VPN and/or having
| privacy.resistFingerprinting turned on in Firefox, but I
| encounter this several times a day. Agreed that it sucks. I know
| Cloudflare is probably damned if they do, and damned if they
| don't, because they're warring with bots, and some of us are
| collateral damage. It's that privacy vs. convenience tradeoff our
| bearded cyber prophets warned us about in the 90s.
| tinglymintyfrsh wrote:
| Offtopic: Quit the rain dances and batten down the hatches for
| tonight's weather rolling through. Some mighty dark clouds are
| rolling through these parts as of writing.
| lta wrote:
| These very annoying behaviors with Firefox/Linux are the reason
| why I'm trying to avoid having my customers using cloudflare at
| all.
| parhamn wrote:
| I emailed John Graham-Cumming about this on March 15th and was
| told he was looping in the right people.
|
| Small browsers (like mine) are basically unusable now because of
| this. Theyre significantly squeezing everyone into chrome/safari.
| Ours is even chromium based, so super annoying.
| statquontrarian wrote:
| Is it because you have a different UserAgent? Otherwise, how
| would CloudFlare even know your browser is different if you're
| Chromium based?
| joshmanders wrote:
| Fingerprinting.
| tinglymintyfrsh wrote:
| Here's some resources for people interested:
|
| https://coveryourtracks.eff.org
|
| https://www.amiunique.org/fp
|
| https://chrome.google.com/webstore/detail/canvas-blocker-
| fin...
|
| https://addons.mozilla.org/en-
| US/firefox/addon/canvasblocker...
| traveler01 wrote:
| Must be some of the filters Firefox has in place. Same already
| happened me with Brave. Solution might be disabling those Firefox
| filters...
| hombre_fatal wrote:
| You're kinda railing against locks on doors ("I just want them
| all to easily open for me!") without realizing why they are
| there.
|
| You can thank abusers and spammers for ruining the internet for
| you, not website operators trying to deal with spam/bots.
|
| I've had my most inconsequential service taken offline with a $5
| booter because the user wanted to brag on Discord. You can bet I
| default to Cloudflare now.
|
| It's not just for the website operator either. All of my users
| suffer when $5 botnets take down my server too. And it's cheaper
| and cheaper to do that every year thanks to the internet of shit.
|
| So I'm not sure who this "Tell HN" PSA is for. Are the baddies
| going to read about your inconvenience and stop being baddies so
| we don't need to use captchas anymore?
| IYasha wrote:
| There are many less inhumane ways of treating clients than CF
| does. Just because you needed them to protect your host doesn't
| justify their abuse of power.
| Analemma_ wrote:
| This isn't true, though. Or at least it's not true if you
| want a free, set-it-and-forget-it solution, which people do
| for hobbies and side projects. You might want to take a look
| at https://news.ycombinator.com/item?id=21719793, which is a
| story about somebody who started out _trying_ to avoid
| CloudFlare and eventually had to surrender because there was
| no other way to keep his site online against attackers.
| IYasha wrote:
| > There are many less inhumane ways of treating clients
| than CF does.
|
| >> This isn't true, though.
|
| What??
|
| Also, you are probably missing my point: it's not like
| sites don't need protection, it's the unfriendliness of how
| CF implements it.
| rurp wrote:
| This isn't nearly the intractable problem you seem to think it
| is. Requiring intense tracking/fingerprinting is done because
| it's easy and/or profitable. Enough pushback on those decisions
| will make the internet a better place.
| statquontrarian wrote:
| I'm fine with CloudFlare doing DDoS or spam protection. I'm not
| doing a DDoS nor spam. I'm happy to help them fix their
| algorithm. Not only did they not respond to the community post,
| but they auto-closed it to add insult to injury.
| hombre_fatal wrote:
| Well, until you have an algo that can mind read, "I'm not a
| spammer guys, gosh!" isn't good enough, I'm afraid.
|
| And yes, it's annoying that we live in that world. In 1999
| you could probably assume a request was human with a User-
| Agent regex.
|
| In 2024, your smart toaster could be saturating your AT&T
| Fiber uplink without you even knowing while you're rage-
| posting in Cloudflare's forums about HAR files and how you're
| not a bot.
| statquontrarian wrote:
| > until you have an algo that can mind read, "I'm not a
| spammer guys, gosh!" isn't good enough, I'm afraid.
|
| As mentioned, it works fine in Chrome on the same computer.
| CloudFlare has engaged and is investigating, thanks to this
| HN post.
| jeroenhd wrote:
| A single Chrome install is easier to identify than a
| single Firefox install with default settings. Firefox is
| also an outlier in terms of global browser traffic (3-5%
| for normal websites).
| statquontrarian wrote:
| If there is some Firefox privacy feature that CloudFlare
| considers overbearing, I'd consider turning it off, but I
| don't even know what the problem is. CloudFlare provides
| zero diagnostics and didn't engage in the community post.
| These two latter points are what annoy me. If CloudFlare
| has some philosophical disagreement with Firefox, then
| fine, but tell me what it is so that I can consider
| disabling the Firefox feature.
| marklubi wrote:
| > You're kinda railing against locks on doors
|
| No, definitely not. I'm completely incapable of logging into
| several different services that have Cloudflare's protection
| (including their own website) if I use Chrome on my iPad. If I
| try on mobile Safari on the same device (which has basically an
| empty history), it goes through just fine.
|
| Something is broken.
| andersa wrote:
| The broken thing is that anyone can send any unsolicited
| traffic anywhere, making Cloudflare a requirement for hosting
| a website. If we had properly authenticated traffic only that
| verifiably comes from a human, we would not need all these
| error prone defenses with false positives.
| MatthiasPortzel wrote:
| Cloudflare DDoS protection and Cloudflare captcha are two
| different services. As a website owner, you can opt into the
| first without the latter.
| IYasha wrote:
| Website owhers usually don't realise that some "nicely
| advertised tech" they're ticking "to protect my poor website
| from evil hackers" is a damn grenade launcher in an infant's
| hands. Ironically, they're also shooting themselves in the
| feet by blocking their own customers.
| yamtaddle wrote:
| Losing as much as a couple percent of annual sales to
| prevent card-stuffers from getting through--which can knock
| you off your payment processor completely--is a pretty easy
| call for a lot of businesses.
|
| Not sure how the math works out for ad-supported sites, but
| it pretty strongly favors "moderately-aggressive automated
| blocking" for those taking direct payments.
| newaccount74 wrote:
| It may be understandable if it's on a checkout page.
|
| But Cloudflare often enough blocks users from reading
| content pages. Cloudflare could just serve their cached
| static content instead of showing Captchas.
| TheRealPomax wrote:
| Only if, in your analogy, putting the key into the lock,
| turning it, hearing click, and having the door open reveals the
| same fucking door instead of what's behind it.
| [deleted]
| kylehotchkiss wrote:
| I use Safari with 1Blocker, while on private relay. I see
| surprisingly almost no Cloudflare verifications at all. I can't
| tell if it's their private access tokens implementation going
| live yet or just higher levels of trust for traffic for Private
| Relay since it requires a paid iCloud+ account
|
| https://blog.cloudflare.com/eliminating-captchas-on-iphones-...
| jshier wrote:
| Yes, that due to the higher confidence of a real person using
| an Apple device with a paid iCloud+ account as well as the
| simple fact that Private Relay uses Cloudflare underneath to
| route much of the traffic (as well as other networks).
| harry8 wrote:
| Let's all note just how much market share cloudflare got before
| throwing this switch. While they took over a huge part of the web
| this sort of thing never happened. Now it seems very much harder
| to even attempt to browse with slightly more anonymity.
|
| Ladies and gentlemen start your conspiracy theories.
| evilspammer wrote:
| This in fact happened all along and we warned you and got
| downvoted for it until now.
| tinglymintyfrsh wrote:
| Right observation, but wrong conclusion.
|
| Cloudflare skews towards a monopolistic monoculture. (Fastly
| and Akamai also exist, but present more friction.)
|
| The issue is that with one transparent proxy and application
| firewall for a large fraction of web traffic, it has to cover
| uncountable edge-cases to not leave out nonzero users from a
| large number of sites. It's unlikely to be malicious intention
| here, but more likely accidents, oversights, and lack of
| alternatives.
| IYasha wrote:
| It's been breaking by life.
|
| "Your browser is obsolete. Go shoot yourself. Have a nice day."
| timwaagh wrote:
| I have the same issue on Chrome on my corporate laptop.
| dfsl wrote:
| Hello, We burnt our hands with Cloudflare! This is our experience
| with Cloudflare in detail: https://freesoftware.life/how-using-
| cloudflare-free-plan-des...
| tick_tock_tick wrote:
| This might be the worst write up I've ever read. You don't have
| a single graph or metric to support any of your theory's. It
| reads like a rambling of lightly connected ideas intermixed
| with a poor understanding of how the internet works.
| nathants wrote:
| waiting for someone to solve trust/reputation on the internet
| like colbert eating popcorn.
| colesantiago wrote:
| My service uses Cloudflare and we get hundreds of millions of
| bots trying to abuse our service.
|
| The other day I stopped the Cloudflare CAPTCHA for a day just to
| see what would happen and the next day I saw fake orders with
| disputes and credit card testing which costed my business
| thousands.
|
| I don't think this is a major problem for consumers, but for
| merchants, without CAPTCHA it is _even worse_ for merchants.
|
| I think I'll keep the CAPTCHA turned on, not sure if there is an
| alternative though.
| asdadsdad wrote:
| would a fraud detection solution that you can query for IPs,
| cards without captcha work?
| asdadsdad wrote:
| (if so, I have one =) )
___________________________________________________________________
(page generated 2023-04-28 23:01 UTC)