6 ms·

I've had the exact same problem for a while. Here are some of the sites I've been unable to access (found by searching for "just a moment" in my browser history

I've had the exact same problem for a while. Here are some of the sites I've been unable to access (found by searching for "just a moment" in my browser history): - https://gitlab.com/users/sign_in https://gitlab.com/users/sign_in - https://steamdb.info/login/ https://steamdb.info/login/ - https://www.zabbix.com/forum/ https://www.zabbix.com/forum/ - https://casetext.com/ https://casetext.com/ - https://namemc.com/login https://namemc.com/login - https://spinroot.com/ https://spinroot.com/ - https://camelcamelcamel.com/ https://camelcamelcamel.com/ It's really annoying and Cloudflare is apparently doing nothing to fix it as this has been going on for months if not years. I guess Cloudflare just hates the open web and really wants to enforce Chrome/Chromium/Blink hegemony.

megous 3y ago
Yeah, gitlab also blocks me from logging in (via its cloudflare use). It did so even when we paid for it. We no longer do. (for other reasons, but anyway, good riddance)
zer8k 3y ago
I haven't had any problems on Waterfox. However, it is absurd to me I need javascript to simply visit a website anymore.
- kmlx 3y ago
  that’s because websites have evolved into web apps.
  - adrianN 3y ago
    Most websites haven’t done that
- michaelt 3y ago
  Sadly, the fact a given site works for you or me is no guarantee it works for someone else. These bot detection systems tend to use all manner of imprecise statistical heuristics and weird fingerprinting. Perhaps AegirLeet has a graphics card that a popular web scraper pretends to have. Maybe they're in a suspicious timezone. Maybe they've installed a font usually only found on a different operating system. Maybe I'm never blocked because I have an excellent IP reputation, due to regular visits to approved websites.
  - flangola7 3y ago
    Fingerprinting is scarily accurate now, strangely. https://fingerprint.com/ https://fingerprint.com/
    - stjohnswarts 3y ago
      yeah, starting that that invisible pixels and cookie tracking are way in the past and unless you're using something like tor (and not changing the resolution) then they know who you are. I mean you can still block ads and cookies, but I figure they really do know who you are.
    - marcosdumay 3y ago
      Somehow, it doesn't matter. Like the fact that the author shared non-repudiable identification information with the site also didn't matter and he was classified as a robot anyway.
    - veave 3y ago
      As a data point, enabling privacy.resistFingerprinting on Firefox defeats this website.
amadeuspagel 3y ago
If only there was some open standard for browsers to verify that a real human is visiting a website, so that website owners wouldn't have to rely on bespoke hacks that only work in chrome.
- systemvoltage 3y ago
  This would be great if it didn’t have any downsides. China has a system like that: QR code to login everywhere. Everything is linked to your phone number which is given after taking a picture of you and official ID. We are gonna have to live in a slightly bot-rich society to keep this at bay. It starts with browser control. And then, ends with needing human verification to ssh into a server that you own. Let’s just build better security.
- shadowgovt 3y ago
  They're booing, but you know you're right. ;)
- danShumway 3y ago
  The problem isn't that the hack only works in Chrome, it's that the system being proposed is inherently terrible regardless of how it's implemented. There is no such thing as a reliable standard for browsers to verify that users are human that does not harm the open web or threaten user autonomy and accessibility. Every single accessibility standard and user choice about extensions and access is abusable by malicious actors, and every security measure to block abuse of automated scraping or access also blocks valid use cases. Making it a web standard won't change that fact.
- yjftsjthsd-h 3y ago
  Yes, an open standard that any browser could use to prove human interaction would be great. It's also impossible, of course; all attempts so far lock in specific software or hardware stacks and then pretend that bots can't use those systems, guaranteeing both false negatives and false positives.
clsec 3y ago
It happens to me all the time. And it has been going on for years, but it's getting noticeably worse over time. One way or another you have to pay to use the web, be it costing you loss of access because of your strict privacy settings or paying by giving away your privacy. There's no win here..
adammartinetti 3y ago
Would you be willing to share a rayID you see during one of these looping challenges? I'm the PM for Cloudflare's challenge platform, and we'd love to look into this. RayIDs contain no PII so you can share publicly, or feel free to drop me an email at amartinetti at cloudflare. We'll also release a reporting mechanism soon, so in the future you can let us know when you see these issues and we can react to them quickly.
- AegirLeet 3y ago
  Here's a handful: - 7f395b5ddfe43a54 - 7f395ca09bfa3a54 - 7f395d8afaf73a54 - 7f395f075e33690d - 7f396102afef35fd
  - adammartinetti 3y ago
    Thanks for the examples! Would you be able to share browser and extension information with me? If you don't want to share publicly I've dropped my email in this thread.
    - AegirLeet 3y ago
      https://pastebin.com/79bBdBhX https://pastebin.com/79bBdBhX
- itscrush 3y ago
  Here's some loop samples; - Gitlab; Ray ID: 7f3961b4ec46c443 - Zabbix; Ray ID: 7f39624d982bc32e - NameMC; Ray ID: 7f3962e68d251871 - Camelcamelcamel; Ray ID: 7f3962eb9cbb421f Easily can recreate at least the never ending loop by flipping on ublock origin's 3rd party scripts and 3rd party frame blocking, which matches their recommended medium settings.
  - adammartinetti 3y ago
    Thanks so much to you and everyone else who's supplied these. I'm collecting them now, and the team is looking into this.
adrr 3y ago
Users want to chrome hegemony and don't care about the open web or Firefox. Its the number #1 browser on desktop even though it doesn't come with the OS. Windows comes with edge and macs come with safari. Users have to download Chrome.
- j45 3y ago
  All browsers so far have come and gone in popularity. Even when it seemed unimaginable.
  - Iulioh 3y ago
    But today everything but Firefox is Chromium. That's a little different
    - warrenm 3y ago
      And 20 years ago everything was IE (at >90% penetration)
      - Iulioh 3y ago
        The problem is Chromium ,not Chrome Like you have the illusion of choice, that's what I'm talking about and that's different
        j45 3y ago
        Firefox entered into a contract per-install with Google that did no evil while Google iirc was building their own browser secretly. Browser engines are now open source a lot more than they were. I don’t think it’s about illusion of choice as much as some browsers actively working to degooglify themselves from Chromium and maintain it. Some browsers are maintaining their own forks, others aren’t.
deleted 3y ago
[deleted]
unmole 3y ago
I can access them all fine using Firefox on Android.
stjohnswarts 3y ago
I see the "are you human" on there with a click, but no looping, it goes straight to the website
ryukoposting 3y ago
I've noticed the same issue for years. The Microsoft acquisition pushed me from Github to GitLab. CloudFlare pushed me back.

megous 3y ago

Yeah, gitlab also blocks me from logging in (via its cloudflare use). It did so even when we paid for it. We no longer do. (for other reasons, but anyway, good riddance)

zer8k 3y ago

I haven't had any problems on Waterfox. However, it is absurd to me I need javascript to simply visit a website anymore.

kmlx 3y ago
that’s because websites have evolved into web apps.
- adrianN 3y ago
  Most websites haven’t done that
michaelt 3y ago
Sadly, the fact a given site works for you or me is no guarantee it works for someone else. These bot detection systems tend to use all manner of imprecise statistical heuristics and weird fingerprinting. Perhaps AegirLeet has a graphics card that a popular web scraper pretends to have. Maybe they're in a suspicious timezone. Maybe they've installed a font usually only found on a different operating system. Maybe I'm never blocked because I have an excellent IP reputation, due to regular visits to approved websites.
- flangola7 3y ago
  Fingerprinting is scarily accurate now, strangely. https://fingerprint.com/ https://fingerprint.com/
  - stjohnswarts 3y ago
    yeah, starting that that invisible pixels and cookie tracking are way in the past and unless you're using something like tor (and not changing the resolution) then they know who you are. I mean you can still block ads and cookies, but I figure they really do know who you are.
  - marcosdumay 3y ago
    Somehow, it doesn't matter. Like the fact that the author shared non-repudiable identification information with the site also didn't matter and he was classified as a robot anyway.
  - veave 3y ago
    As a data point, enabling privacy.resistFingerprinting on Firefox defeats this website.

amadeuspagel 3y ago

If only there was some open standard for browsers to verify that a real human is visiting a website, so that website owners wouldn't have to rely on bespoke hacks that only work in chrome.

systemvoltage 3y ago
This would be great if it didn’t have any downsides. China has a system like that: QR code to login everywhere. Everything is linked to your phone number which is given after taking a picture of you and official ID. We are gonna have to live in a slightly bot-rich society to keep this at bay. It starts with browser control. And then, ends with needing human verification to ssh into a server that you own. Let’s just build better security.
shadowgovt 3y ago
They're booing, but you know you're right. ;)
danShumway 3y ago
The problem isn't that the hack only works in Chrome, it's that the system being proposed is inherently terrible regardless of how it's implemented. There is no such thing as a reliable standard for browsers to verify that users are human that does not harm the open web or threaten user autonomy and accessibility. Every single accessibility standard and user choice about extensions and access is abusable by malicious actors, and every security measure to block abuse of automated scraping or access also blocks valid use cases. Making it a web standard won't change that fact.
yjftsjthsd-h 3y ago
Yes, an open standard that any browser could use to prove human interaction would be great. It's also impossible, of course; all attempts so far lock in specific software or hardware stacks and then pretend that bots can't use those systems, guaranteeing both false negatives and false positives.

clsec 3y ago

It happens to me all the time. And it has been going on for years, but it's getting noticeably worse over time. One way or another you have to pay to use the web, be it costing you loss of access because of your strict privacy settings or paying by giving away your privacy. There's no win here..

adammartinetti 3y ago

Would you be willing to share a rayID you see during one of these looping challenges? I'm the PM for Cloudflare's challenge platform, and we'd love to look into this. RayIDs contain no PII so you can share publicly, or feel free to drop me an email at amartinetti at cloudflare. We'll also release a reporting mechanism soon, so in the future you can let us know when you see these issues and we can react to them quickly.

AegirLeet 3y ago
Here's a handful: - 7f395b5ddfe43a54 - 7f395ca09bfa3a54 - 7f395d8afaf73a54 - 7f395f075e33690d - 7f396102afef35fd
- adammartinetti 3y ago
  Thanks for the examples! Would you be able to share browser and extension information with me? If you don't want to share publicly I've dropped my email in this thread.
  - AegirLeet 3y ago
    https://pastebin.com/79bBdBhX https://pastebin.com/79bBdBhX
itscrush 3y ago
Here's some loop samples; - Gitlab; Ray ID: 7f3961b4ec46c443 - Zabbix; Ray ID: 7f39624d982bc32e - NameMC; Ray ID: 7f3962e68d251871 - Camelcamelcamel; Ray ID: 7f3962eb9cbb421f Easily can recreate at least the never ending loop by flipping on ublock origin's 3rd party scripts and 3rd party frame blocking, which matches their recommended medium settings.
- adammartinetti 3y ago
  Thanks so much to you and everyone else who's supplied these. I'm collecting them now, and the team is looking into this.

adrr 3y ago

Users want to chrome hegemony and don't care about the open web or Firefox. Its the number #1 browser on desktop even though it doesn't come with the OS. Windows comes with edge and macs come with safari. Users have to download Chrome.

j45 3y ago
All browsers so far have come and gone in popularity. Even when it seemed unimaginable.
- Iulioh 3y ago
  But today everything but Firefox is Chromium. That's a little different
  - warrenm 3y ago
    And 20 years ago everything was IE (at >90% penetration)
    - Iulioh 3y ago
      The problem is Chromium ,not Chrome Like you have the illusion of choice, that's what I'm talking about and that's different
      - j45 3y ago
        Firefox entered into a contract per-install with Google that did no evil while Google iirc was building their own browser secretly. Browser engines are now open source a lot more than they were. I don’t think it’s about illusion of choice as much as some browsers actively working to degooglify themselves from Chromium and maintain it. Some browsers are maintaining their own forks, others aren’t.

deleted 3y ago

[deleted]

unmole 3y ago

I can access them all fine using Firefox on Android.

stjohnswarts 3y ago

I see the "are you human" on there with a click, but no looping, it goes straight to the website

ryukoposting 3y ago

I've noticed the same issue for years. The Microsoft acquisition pushed me from Github to GitLab. CloudFlare pushed me back.