3 ms·
That requires JavaScript. CloudFlare does have a JS-only challenge, which presumably does this type of thing, but this has a couple different problems. From a
by mikegerwitz 10y ago
That requires JavaScript.
CloudFlare does have a JS-only challenge, which presumably does this type of thing, but this has a couple different problems. From a security perspective, you're executing arbitrary software, which is unwise, especially if you're looking for anonymity. The other issue is that the software is also proprietary.
https://support.cloudflare.com/hc/en-us/articles/204191238-What-are-the-types-of-Threats- https://support.cloudflare.com/hc/en-us/articles/204191238-W...
"During a JavaScript challenge you will be shown an interstitial page for about five seconds while CloudFlare performs a series of mathematical challenges to make sure it is a legitimate human visitor."
Related: I have started trying to get into contact with webmasters of sites that enable JS Challenges; my template is at the bottom of this page; it'd be great if others could do the same:
https://gitlab.com/mikegerwitz/dotfiles/blob/master/emacs.d/mail.org https://gitlab.com/mikegerwitz/dotfiles/blob/master/emacs.d/...
- gnud 10y agoGood point. The Cloudflare capthchas I've seen seemed to use Javascript, but maybe it's just incredibly good CSS. Interestingly, while a javascript calculation might leak more information to CloudFlare (since they might collect other info beseides the result of a proof-of-work function), it would probably leak less to anyone trying to analyze tor traffic from the outside? Seems to me like it would be harder to correlate the two ends of the tor circuit.
- mikegerwitz 10y agoIt'd be harder to do traffic analysis, yes, though I really wonder why it makes so many requests to begin with. I'd like to see an analysis of the CAPTCHA. Considering that they allow it without JS enabled, I wonder why they'd need any requests at all.
- JumpCrisscross 10y ago> The Cloudflare capthchas I've seen seemed to use Javascript They have a non-JS version, too.