3 ms·
Ask HN: Anyone else frustrated with “secure connection checks”?
Many sites seem to deploy cloudflare's bot check / secure connection check. And the thing outright does not seem to work with all browsers or setups. Web seems to slowly fall in to the "just use chrome" hole.
- mattl 4y agoWhat browser/OS are you using? What country are you in? Are you using Tor?
- coldtea 4y agoIt can happen on both Windows and Mac, with both Chrome/Firefox. I've seen it happen in Western Europe just fine. No Tor. You don't need to have some "exotic" setup to see this. https://www.google.com/search?q=cloudflare+browser+check+annoying https://www.google.com/search?q=cloudflare+browser+check+ann...
- mattl 4y agoDo you get a Cloudflare Ray ID on the page when you’re being asked? You can send that to the website admin and ask them to check for you.
- pinko 4y agoForgive the dumb question, but what can a friendly website admin do with the Ray ID you send them, that can help you as a user, assuming they put Cloudflare in the middle as a CAPTCHA in the first place for a reason unrelated to you, and still want/need it there?
- mattl 4y agoThey can look up why you were blocked, your ISP, your local POP, the page you were requesting and if it was because of a firewall rule they’ll see that too. Basically everything unique about your request. So if they’re accidentally blocking people because a firewall rule is misconfigured you’ll let them know. In a previous job we used Cloudflare and found some of our remote workers were triggering a SQL injection on the website by updating our WordPress blog.
- Cloudef 4y agoLinux/Qutebrowser, had to use firefox to access the site. Some sites won't work even in firefox unless I use private window.
- mattl 4y agoWhat's your user agent string on Qutebrowser?
- eerikkivistik 4y agoThe funniest thing I've seen recently, is government API services that have been put behind Cloudflare. Which means, you literally cannot access them without a browser. Let me reiterate, you cannot use machine-to-machine APIs without a browser.
- switch007 4y agoDo they require an interactive oauth2 flow too?
- eerikkivistik 4y agoI’m sure they will now that you suggested it :)
- anthonyhn 4y agoYes, it can be quite frustrating. On my search engine[0] I tag sites that use captcha services and browser checks so that the user has more transparency and can choose to avoid sites that use these services if they want. [0] https://ichi.do https://ichi.do
- VoodooJuJu 4y agoWhat bothers me is the mendacity. No, you're not checking for a "secure connection". What you're doing is taking a fingerprint, to both deanonymize me and detect if I'm a bot.