10 ms·
Ask HN: How does archive.is bypass paywalls?
If it simply visits sites, it will face a paywall too. If it identifies itself as archive.is, then other people could identify themselves the same way.
- gregjor 3y ago[flagged]
- RicoElectrico 3y agoNice try, media company employee ;) /jk
- PTOB 3y agoMy sentiments exactly.
- lcnPylGDnU4H9OF 3y agoI think a browser extension which people who have access to the article use to send the article data to the archive server.
- flerovium 3y agoCan you explain? Who has purchased the subscription? I'm sure there's a no-redistribution clause in the subscription agreement.
- lcnPylGDnU4H9OF 3y agoThe person who installed the browser extension would be paying the subscription and ignoring said clause.
- flerovium 3y agoBut what is the relationship between archive.is and the user who installed the extension?
- inconceivable 3y agodude... haha it's a random person on the internet who is doing it for free.
- phneutral26 3y agoThe user helps free the Internet by using archive.is as an openly accessible backup platform.
- lcnPylGDnU4H9OF 3y agoThey (archive.is) would have built the extension to send the current page content to their servers and the user would have installed it so they can archive internet pages. https://help.archive.org/help/save-pages-in-the-wayback-machine/ https://help.archive.org/help/save-pages-in-the-wayback-mach... (item 2)
- Stagnant 3y agoYou are confusing archive.is with archive.org. Although archive.is does have an extension[1] it doesn't appear to capture any of the page contents, it just simply sends the url for archive.is to crawl. 1: https://chrome.google.com/webstore/detail/archive-page/gcaimhkfmliahedmeklebabdgagipbia https://chrome.google.com/webstore/detail/archive-page/gcaim...
- lcnPylGDnU4H9OF 3y agoI wasn't exactly confusing them but yeah, I did link to an archive.org article. I was having difficulty finding something specific to archive.is. I think the distinction between the two is moot in this post. The question could very well have been "How does archive.org bypass paywalls?" Though it's interesting that archive.is seems to just crawl the URL. Indeed that means they wouldn't necessarily be able to bypass the paywall.
- riku_iki 3y agocurious if eventually companies with start watermarking articles and catch and sue extension users.
- lcnPylGDnU4H9OF 3y agoI suspect most content publishers would go to the source. If there are people who are already willing to pay for subscriptions and ignore the terms of those subscriptions, it's not much of a stretch that they'll ignore the fact that they got their subscription cancelled once (or twice, or however many times). The publisher would more likely see results taking legal action against the archivist.
- dwater 3y agoIt didn't stop the RIAA from suing loads of people over downloading mp3s in the past 2 decades, claiming damages of thousands of dollars per song the individual downloaded.
- riku_iki 3y agoin this case (archive.is) they have stronger case, since many people who potentially could buy subscription read it on archive.is because extension user violated terms of subscription. Also, extension likely has also terms of usage prohibiting uploading copyrighted content shifting liability on users.
- sam0x17 3y ago*uploaded They went after seeders
- riku_iki 3y agodownloaders also received legal letters.
- AlbertCory 3y agoThat is how RECAP works ("Pacer" spelled backwards). In that case, the government is fine with it.
- wolverine876 3y agoI think that's how Sci-hub works, at least at some time in the past.
- JCharante 3y agoI thought people would send their journal credentials to Sci-hub
- phoenixreader 3y agoYou mean the pages are crowdsourced? I don’t think so because many pages are archived only upon request. If I ask to archive a new page, archive.is provides it very quickly. This is not possible if the archive is built from crowdsourced data.
- Miner49er 3y agoAccording to their blog they use AMP: https://blog.archive.today/post/675805841411178496/how-does-archive-bypass-hard-paywalls-for#notes https://blog.archive.today/post/675805841411178496/how-does-...
- JohnFen 3y agoWow, an actually good use for Amp? Amazing.
- Aachen 3y agoI'm sure it was an accident or honest mistake!
- flerovium 3y agoThis explanation is incomplete. Counterexample: Amp pages are paywalled: https://www.wsj.com/articles/freeze-or-cut-spending-fight-is-main-event-in-debt-ceiling-talks-3ffccb?mod=hp_lead_pos1&=1 https://www.wsj.com/articles/freeze-or-cut-spending-fight-is... https://amp.wsj.com/articles/freeze-or-cut-spending-fight-is-main-event-in-debt-ceiling-talks-3ffccb?mod=hp_lead_pos1 https://amp.wsj.com/articles/freeze-or-cut-spending-fight-is... archive.is isn't: https://archive.md/LaiOX https://archive.md/LaiOX
- Reventlov 3y agoI can access the wsj article without any account using https://gitlab.com/magnolia1234/bypass-paywalls-firefox-clean https://gitlab.com/magnolia1234/bypass-paywalls-firefox-clea... (bypass paywall clean)
- Deathmax 3y agoFor WSJ at least, it appears that archive.is is fetching the AMP page, which returns the full content of the article and is hidden with CSS, and modifying the page to unhide the paywalled content + hide ads. It might be using other techniques as well for bypassing paywalls, be it referer/user-agent spoofing (some old archives of sites that echo back HTTP request headers have archive.is sending a Referer of google.co.uk).
- janejeon 3y ago> If it identifies itself as archive.is, then other people could identify themselves the same way. Theoretically, they could just publish the list of IP ranges that canonically "belongs" to archive.is. That would allow websites to distinguish if a request identifying itself as archive.is is actually from them (it fits one of the IP ranges), or is a fraudster.
- flerovium 3y agoIn theory, this might work. But is it true? Do lots of sites have an archive.is whitelist?
- arbitrage 3y agoI really don't see why they would, if they're using a paywall in the first place.
- w1nst0nsm1th 3y agoFollow the magnolia trail...
- lazzlazzlazz 3y agoIt would be far better and more secure for archive.is to publish a public key on its site and then sign requests from its private key, which sites could optionally verify.
- xiekomb 3y agoI thought they used this browser extension: https://gitlab.com/magnolia1234/bypass-paywalls-chrome-clean https://gitlab.com/magnolia1234/bypass-paywalls-chrome-clean
- flerovium 3y agoThat extension does work, but do we know they use it?
- marcod 3y agoThey don't always use it, because I can archive a new page from my mobile phone browser, which doesn't even support extensions. My guess is that most content providers with paywalls serve the entire content, so search engines can pick it up, and then use scripts to raise the paywall - archive.is takes their snapshot before that happens / doesn't trigger those scripts.
- DrDentz 3y agoIt's actually the opposite, for some news sites this extension links to archive.is because that's the only known way to bypass the paywall.
- nora-puchreiner 3y agoThere are known ways to bypass paywall which are just impossible to implement within a browser extension while trivial on 12ft or archive. For example, to use Ukrainian residential proxy as some news websites granted free access from.
- mr-pink 3y agoevery time you visit they force some kid in a third world country to answer captchas until they can pay for one article's worth of content
- retrocryptid 3y agoMany (most?) "big content" sites let Google and Bing spiders scrape the contents of articles so when people search for terms in the article they'll find a hit and then get referred to the pay wall. Google doesn't want everyone to know what a Google indexing request looks like for fear the CEO mafia will institute shenanigans. And the content providers (NYT, WaPo, etc.) don't want people to know 'cause they don't want people evading their paywall. Or maybe they're okay with letting the archive index their content...
- peter422 3y agoGoogle gives precise details about how to verify their bot is crawling your site and how to denote what content is paywalled and what isn’t.
- Aachen 3y agoBingo. This is what I use to incentivize using a nonmonopolistic search engine to find the few sites I run.
- wolverine876 3y agoDoesn't almost every site on the web know exactly what the Google bot looks like?
- Atlas22 3y agoJust FYI google and bing publish their user agent strings[1][2] for the crawlers. At least in my experience most of the typical ad-infested and paywalled news sites wont display the paywall if you change the user agent to a crawler they prefer. [1] https://developers.google.com/search/docs/crawling-indexing/overview-google-crawlers https://developers.google.com/search/docs/crawling-indexing/... [2] https://www.bing.com/webmasters/help/which-crawlers-does-bing-use-8c184ec0 https://www.bing.com/webmasters/help/which-crawlers-does-bin...
- jwildeboer 3y agoIt’s internet magic. <rainbowmagicsparkles.gif> ;)
- Yujf 3y agoI don't know about archive.is, but 12ft.io does identify as google to bypass paywalls afaik
- strunz 3y ago12ft.io also doesn't work or is disabled for many sites that archive.is still works on
- hda111 3y agoMaybe because the creator of 12ft.io isn't anonymous
- janejeon 3y agoWouldn't sites be able to see that requests from 12ft.io isn't coming from Google's IPs?
- dpifke 3y agoYes. Google recommends using reverse DNS to verify whether a visitor claiming to be Googlebot is legitimate or not: https://developers.google.com/search/docs/crawling-indexing/verifying-googlebot https://developers.google.com/search/docs/crawling-indexing/... You can also verify IP ownership using WHOIS, or by examining BGP routing tables to see which ASN is announcing the IP range. Google also publishes their IP address ranges here: https://www.gstatic.com/ipranges/goog.json https://www.gstatic.com/ipranges/goog.json
- nora-puchreiner 3y agohttps://search.google.com/test/rich-results?url= https://search.google.com/test/rich-results?url= operates from legit Googlebot IPs so it allows anyone to get the paywalled content even archive.is fails to fetch (from theinformation.com, for example)
- rahimnathwani 3y ago"Google recommends using reverse DNS to verify..." This is almost right. They recommend two steps: 1. Use reverse DNS to find the hostname the IP address claims to have. (The IP address block owner can put any hostname in here, even if they don't own/control the domain.) 2. Assuming the claimed hostname is on one of Google's domains, do a forward DNS lookup to verify that the original IP address is returned. The second step is the important one.
- chrisco255 3y agoJust archived a website I created. It looks like it runs HTTP requests from a server to pull the HTML, JS and image files (it shows the individual requests completing before the archival process is complete). It must then snapshot the rendered output, then it renders those assets served from their domain. Buttons on my site don't work after the snapshot, since the scripts were stripped.
- strunz 3y agoYour missing the point of "how does it bypass firewalls"
- wackget 3y agopaywalls*
- sshine 3y ago[flagged]
- chrisco255 3y agoSorry, thought it was obvious. Since it's using backend infrastructure to fetch the assets, it can crawl them as a bot in the same way that search engines do, without allowing cookies to be saved. Since scripts are often involved in the full rendering of a page, it clearly does allow for the scripts to load before snapshotting the DOM. But only the DOM and the assets and styles are preserved. Scripts are not. Most paywalls are simple scripts. If you disable JS and cookies, you'll often see the full text of an article.
- killingtime74 3y agoSome paywalls don't hide the content with JavaScript. It's just not there. They make you pay and then redirect you to another page.
- joegibbs 3y agoThere are a lot of paywalls that are done server-side - for instance the Herald Sun, which is one of the biggest newspapers in Australia, does it like this. Even if you check the responses there's nothing in them but links to subscribe and a brief intro to the article.
- jrochkind1 3y agoEvery once in a while I _do_ get a retrieval from archive.is that has the paywall intact. But I don't know the answer either.
- not_your_vase 3y agoThey use you, as a proxy. If you (who archives it) have access to the site (either because you paid or have free articles), they can archive it too. If you don't have access, they only archive a paywall.
- fxtentacle 3y agoProbably the people who operate archive.is just purchased subscriptions for the most common newspaper sites. And then they can use something like https://pptr.dev/ https://pptr.dev/ to automate login and article retrieval. I guess the business model is to inject their ads into someone else's content, so kinda like Facebook. That would also surely generate more money from the ads than the cost of subscribing to multiple newspapers.
- tivert 3y ago> Probably the people who operate archive.is just purchased subscriptions for the most common newspaper sites. And then they can use something like https://pptr.dev/ https://pptr.dev/ to automate login and article retrieval. I wouldn't be surprised. IIRC, the whole thing is privately funded by one individual, who must have a lot of money to spare.
- Stagnant 3y agoI don't think anyone knows who runs archive.is. I've tried looking into it a couple of times in the past but there is surprisingly little information to be found. It must cost thousands if not tens of thousands a month to host all that data and AFAIK they do not monetize it in any way. From what I gather it probably is some Russian person as there were some old stackoverflow conversations regarding the site that lead to an empty github account with a russian name. Also back in 2015 the site owner blocked all Finnish ip addresses due to "an incident at the border"[1]. Finnish IPs have since been unblocked. It appears the site owner somehow thought he could end up in EU wide blacklist which seemed like very conspiratorial thinking from him. 1: https://archive.is/Pum1p https://archive.is/Pum1p
- Swiftness6022 3y ago[dead]
- deleted 3y ago[deleted]
- 3y ago
- alex_young 3y agoNot specifically related to archive.is, but news sites have a tightrope to walk. They need to both allow the full content of their articles to be accessed by crawlers so they can show up in search results, but they also want to restrict access via paywalls. They use 2 main methods to achieve this: javascript DOM manipulation and IP address rate limiting. Conceivably one could build a system which directly accesses a given document one time from a unique IP address and then cache the HTML version of the page for further serving.
- w1nst0nsm1th 3y agoIf the people who know that tell you, they could lose access to said ressources. But it's kind of an open secret, you just don't look in the right place.
- w1nst0nsm1th 3y agoFollow the magnolia trail...
- riffic 3y agoyour browser usually downloads an entire article and certain elements are overlayed. it's trivial to bypass most paywalls isn't it?
- aidenn0 3y agoNot for some (I think the Wall Street Journal). Apparently the AMP version of the page does work this way for WSJ though, which is how IA gets around the paywall.
- jakedata 3y agoAlas it doesn't allow access to the comment section of the WSJ which is the only reason I would visit the site. WSJ comments re-enforce my opinion of the majority of humanity. My father allowed his subscription to lapse and I won't send them my money so I will just have to imagine it.
- aaron695 3y ago[dead]
- throwaway81523 3y agoOff topic but for years I've been using a one-off proxy to strip javascript and crap from my local newspaper site (sfgate.com). It just reads the site with python urllib.request and then does some DOM cleanup with beautiful soup. I wasn't doing any site crawling or exposing the proxy to 1000s of people or anything like that. It was just improving my own reading experience. Just in the past day or so, sfgate.com put in some kind of anti scraping stuff, so urllib, curl, lynx etc. now all fail with 403. Maybe I'll undertake the bigger and slower hassle of trying to read the site with selenium or maybe I'll just give up on newspapers and get my news from HN ;). I wonder if archive.is has had its sfgate.com experience change. Just had to mention them to stay slightly on topic.
- 1ark 3y agoThey are probably just checking headers such as user agent and cookies. Would copy whatever your normal browser sends and put it in the urllib.request. If that doesn’t work, then it is likely more sophisticated.
- throwaway81523 3y agoI will try that, but a quick look at the error page makes me think it tries to run a javascript blob.
- chrisco255 3y agoIt probably does. But there are better modern tools like headless Chrome / Puppeteer that can fully render a page with scripts.
- deleted 3y ago[deleted]
- ksala_ 3y agoThey're just checking the user agent $ curl -s -I 'https://www.sfgate.com/' -H 'User-Agent: curl/7.54.1' | head -1 HTTP/2 403 $curl -s -I 'https://www.sfgate.com/' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/113.0' | head -1 HTTP/2 200 One "trick" is that Firefox (and I assume Chrome?) allow you to copy a request as curl - then you can just see if that works in the terminal, and if it does you can binary search for the required headers.
- shipscode 3y agoWhat happens when you first load a paywalled article? 9 times out of 10 it shows the entire article before the JS that runs on the page pops up the paywall. Seems like it probably just takes a snapshot prior to JS paywall execution combined with the Google referrer trick or something along those lines.
- armchairhacker 3y agoA lot of sites don't seem to care about their paywall. Plenty of them load the full article, then "block" me from seeing the rest by adding a popup and `overflow: hidden` to `body`, which is super easy to bypass with devtools. Others give you "free articles" via a cookie or localStorage, which you can of course remove to get more free articles. There are your readers who will see a paywall and then pay, and there are your readers who will try to bypass it or simply not read at all. And articles spread through social media attention, and a paywalled article gets much less attention, so it's non-negligibly beneficial to have people read the article for free who would otherwise not read it. Which is to say: the methods archiv.is uses may not be that special. Clear cookies, block JavaScript, and make deals with or special-case the few sites which actually enforce their paywalls. Or identify yourself as archiv.is, and if others do that to bypass the paywall, good for them.
- World177 3y agoI think they might just try all the user agents in the robots.txt. [1] I've included a picture showing an example. In this second image, [2] I receive the paywall with the user agent left as default. There might also just be an archival user agent that most websites accept, but I haven't looked into it very much. [1] https://i.imgur.com/lyeRTKo.png https://i.imgur.com/lyeRTKo.png [2] https://i.imgur.com/IlBhObn.png https://i.imgur.com/IlBhObn.png
- jrochkind1 3y agoThat user-agent seems to be in the robots.txt as _disallowed_, but somehow it gets through the paywall? That seems counter-intuitive.
- World177 3y agoIt's just blocking the root. Look up the specifications for the robots.txt for more information. One purpose is to reduce loads on parts of the website that they do not want indexed.
- KomoD 3y agoNo, / means the entire site, since root and anything lower.
- jrochkind1 3y agoDefinitely incorrect, the paths in the robots.txt are prefixes, so `/` means anything starting with `/`, that is, everything. Look up the specifications for the robots.txt for more information! (Or, for instance, look up how you'd block the whole site in robots.txt if you wanted to!)
- flerovium 3y agoThat's an interesting idea, but is it true?
- World177 3y ago
- firexcy 3y agoMy hypothesis is that they use a set of generic methods (e.g., robot UA, transient cache, and JS filtering) and rely on user reports (they have a tumblr page for that) to identify and manually fix access to specific sites. Having a look at the source of the bypasspaywallclean extension will give you a good idea of most useful bypassing methods. Indeed, most publishers are only incentivized to paywall their content to the degree where most of their audience are directed to pay and they have to leave backdoors here or there for purposes such as SEO.
- thallosaurus 3y agoI just tried it with a local newspaper, it did remove the floating pane but didn't unblur and the text is also scrambled (used to be way worse protected, firefox reader mode could easily bypass it) (https://archive.is/1h4UV https://archive.is/1h4UV)