4 ms·

"Invisible" assuming you have javascript enabled and use a mainstream browser. The failure mode on these is worse than regular captchas because cloudflare won't

"Invisible" assuming you have javascript enabled and use a mainstream browser. The failure mode on these is worse than regular captchas because cloudflare won't even give you a chance to prove that you're a human, you'll just be stuck in a refresh loop.

shortcake27 3y ago
Surely people who disable javascript are used to the majority of the web being broken for them. JS is an integral part of the web, regardless of how people feel about it.
- throwitaway156 3y ago
  it doesnt matter if you enabled it or not, you need to allow Clownflare's guerrilla fingerprinting to be allowed access. Which is a huge downside, unless you have access to a bunch of proxy servers and the knowledge to randomize and spoof your fingerprint accurately.
- Karellen 3y ago
  > Surely people who disable javascript are used to the majority of the web being broken for them. Not really. I'd say >80% of sites I visit are accessible, in that I can read the content of the page I want to look at, with javascript disabled. Of the remainder, I can temporarily switch javascript back on for a tab with two clicks, if I want to read the contents enough, and I think the odds of that site having especially malicious javascript on it is slim. (e.g. mastodon instances) I can also create permanent exceptions for websites in a couple of clicks too, and there are some frequently-visited sites that I have done that for. Don't think of those who disable javascript as browsing with no javascript. Think of it as browsing with javascript disabled by default.
ZiiS 3y ago
He implemented a fallback to a regular captcha to cover this case.
- randunel 3y ago
  But that captcha doesn't work no matter how many times you solve it https://i.imgur.com/1wEy8op.mp4 https://i.imgur.com/1wEy8op.mp4
nonameiguess 3y ago
You don't even need to do anything unorthodox. I'm using Firefox with Javascript enabled, set to block fingerprinting and cross-site cookies, and Cloudflare's bot detector regularly puts me into infinite loops. It's especially frustrating when it's the login page for a paid service doing this to me. Why on earth would I abuse your site with a bot using credentials associated with my real name and payment info?

shortcake27 3y ago

Surely people who disable javascript are used to the majority of the web being broken for them. JS is an integral part of the web, regardless of how people feel about it.

throwitaway156 3y ago
it doesnt matter if you enabled it or not, you need to allow Clownflare's guerrilla fingerprinting to be allowed access. Which is a huge downside, unless you have access to a bunch of proxy servers and the knowledge to randomize and spoof your fingerprint accurately.
Karellen 3y ago
> Surely people who disable javascript are used to the majority of the web being broken for them. Not really. I'd say >80% of sites I visit are accessible, in that I can read the content of the page I want to look at, with javascript disabled. Of the remainder, I can temporarily switch javascript back on for a tab with two clicks, if I want to read the contents enough, and I think the odds of that site having especially malicious javascript on it is slim. (e.g. mastodon instances) I can also create permanent exceptions for websites in a couple of clicks too, and there are some frequently-visited sites that I have done that for. Don't think of those who disable javascript as browsing with no javascript. Think of it as browsing with javascript disabled by default.

ZiiS 3y ago

He implemented a fallback to a regular captcha to cover this case.

randunel 3y ago
But that captcha doesn't work no matter how many times you solve it https://i.imgur.com/1wEy8op.mp4 https://i.imgur.com/1wEy8op.mp4

nonameiguess 3y ago

You don't even need to do anything unorthodox. I'm using Firefox with Javascript enabled, set to block fingerprinting and cross-site cookies, and Cloudflare's bot detector regularly puts me into infinite loops. It's especially frustrating when it's the login page for a paid service doing this to me. Why on earth would I abuse your site with a bot using credentials associated with my real name and payment info?