9 ms·
Cloudflare is free of CAPTCHAs; Turnstile is free for everyone
- out-of-ideas 3y agoRIP JShelter
- vntok 3y agoThis is a good thing. Generally, you shouldn't block fingerprinting from inside the browser, it is only a fool's errand that provides a false sense of security while being open to exploits, new techniques, bypasses and broken sites. If you want to be safe from tracking, run your browser sessions in separate ephemeral containers or even VMs and trash them regularly for example. Qubes OS is at one of the extreme ends of this, but Chrome profiles are sufficient for the vast majority of use cases.
- monista 3y agoCan you please elaborate, how exactly running from fresh container would stop tracking? As I see it, once you get fingerprinted, running from the same environment keeps your fingerprint (excluding (super)cookies, which you could clear inside your browser as well), thus not preventing tracking.
- out-of-ideas 3y agoit's only a good thing as it will be maybe one less plugin to deal with but i'd argue its a bad thing overall; if we cannot use curl/lynx/ect to hit a website to view somebody's squabbling on their blog, to not see the url to an image/video without loading it when you want to, something is amiss. IMO, JS and other newer components are trying to make a general purpose OS out of the browser, and its a bit too much; which yes leads to needing to handle fingerprinting outside the browser; but really all this to stop the adtech from tracking our asses? I do totally agree to regularly trashing of profiles; though the accessibility for more folks needs to be there, IE: the local-system automation of retaining plugin block profiles and a few others. just takes time and energy - but in an era where we uselessly burn energy and call it a currency and folks cling to it, well, it's just another wave to drown in
- deleted 3y ago[deleted]
- charcircuit 3y ago>Audio CAPTCHAs are often much worse than even visual CAPTCHAs for humans to solve, with only 31.2% of audio challenges resulting in a three-person agreement on what the correct solution actually is The goal of CAPTCHAs is for users to prove they are human. It's okay for a CAPTCHA to have multiple solutions that are human like to accept. Is giving up on audio and visual captchas an admission that bot owners have won and they are allowed to freely roam people's sites? I don't understand how this can work though. Lets say someone tries to password stuff on your site. These CAPTCHAs don't do anything to stop the attacker. The attacker can just automate clicking the box if they get the challenge.
- t0mas88 3y agoIt's supposed to detect the automation / not real browser from other signals. They're deliberately vague about what those other signals are.
- charcircuit 3y agoAttackers can and do use real browsers. Browser extentions and OS's input automation can both be used for automation even with unmodified browsers.
- omneity 3y agoWouldn’t be surprised if corporate browser vendors start clamping down on this over time. I wonder which competing/opposing interests could provide counter-pressure to this trend, because let’s face it: caring for user interests is a legacy goal for big tech browser vendors.
- ss1996 3y agoWhat is the point of making the user click the box? Can't that be skipped altogether?
- david_draco 3y agoIt checks lots of browser APIs and makes a proof-of-work calculation in the background. I guess we are getting close to paying for entry with computation.
- KirillPanov 3y agoMoving the mouse causes the browser to enable fingerprintable APIs. You aren't paying with computation, you're paying with your data. https://community.cloudflare.com/t/near-infinite-loop-of-human-verification/483217?page=2 https://community.cloudflare.com/t/near-infinite-loop-of-hum...
- david_draco 3y agoI took it from the article: "We find and stop bots by running a series of in-browser tests, checking browser characteristics, native browser APIs, and asking the browser to pass lightweight tests (ex: proof-of-work tests, proof-of-space tests) to prove that it’s an actual browser." but yes, not yet.
- isoprophlex 3y agoThe way you move your mouse, the timing of the click button down/button up events, all those things go into some algo to determine if you're a bot or not Edit: actually not, I'm full of shit, ignore me
- tritiy 3y agoThe article stated that this has nothing to do with it and the click would technically not even be necessary. It is just a way to start the procedure where Turnstile verifies your browser.
- viraptor 3y agoI wish they also included the report link on the failed attempts, so I can let them know when Turnstile stops me from seeing websites on my mobile about every other week. I know other people are annoyed by captchas for good reasons, but this system also sucks unfortunately. Just a rant / modern web sucks / CloudFlare effective monopoly sucks. There are other providers - please give them a go to diversify the web a bit.
- Rebelgecko 3y agoYup. I run into this a lot with Firefox and it's super frustrating when some website's homepage just gives you a cloudflare error and a message that says "bummer bro, you're not allowed to see this. Here's a Ray ID that won't actually help you fix the issue" I've let airlines and other companies know that Cloudflare isn't letting me buy their products but unsurprisingly they don't care (or tell me to clear my cookies)
- TJSomething 3y agoI'd be interested in other DDoS mitigation providers for any site in the sub-$100/month price category. The only other ones I know are Amazon and Microsoft, and those tie you to their clouds.
- viraptor 3y agohttps://www.x4b.net/protection/prices https://www.x4b.net/protection/prices is on the cheap side, but I've not used them yet. Amazon you can use without hosting in their cloud by proxying all the CloudFront traffic to your external host. It may not be the best option long term, but with low traffic it should work fine. Ovh and Hetzner provide their own solutions. Opinions are mixed there, but they both have big pipes at their disposal.
- yuumei 3y ago> Second, we find that a few privacy-focused users often ask their browsers to go beyond standard practices to preserve their anonymity. This includes changing their user-agent > those users can immediately understand the issue and make a conscientious choice about whether they want to allow their browser to pass a challenge. So they will block privacy-focused users. I guess VPNs will be blocked too. It seems they have just removed the captcha part of their system and are spinning it as a good thing to block certain users.
- qsi 3y agoI am curious to see how this works in practice. When I went to their Turnstile sign-up page [0], that is itself protected, I had no problems passing the test despite a slew of privacy-focused features enabled in my browser. [0] https://dash.cloudflare.com/sign-up?to=/:account/turnstile https://dash.cloudflare.com/sign-up?to=/:account/turnstile
- zh3 3y agoInterestingly, although my Firefox ESR passed the test, that page immediately made my laptop's fan spin up (normally only does that on media-heavy pages) - possibly thr "proof of work" test they mention in the article?
- OJFord 3y agoI find that happens with canvas/webGL blocked on pages which try to use it.
- justinclift 3y agoTesting that link just now with Tor, it seemed to pass their checks ok. Hopefully blocking Tor users will mostly be a thing of the past... :)
- Bu9818 3y agoThe captcha on this page takes a few seconds then says "Failure", with no message, then restarts itself, when using Tor Browser on the Safer mode. edit: Was able to get a mix of a few successes and a few failures upon multiple browser restarts. Maybe I was lucky to avoid a discriminated exit node? I'm not sure if IP address is a factor here.
- jerrygoyal 3y agoI'm thinking would a simple chrome extension that clicks on that checkbook work?
- tgsovlerkhgsel 3y agoHow well does this work in practice? Does it block users who have relatively mundane settings like Firefox with "resist fingerprinting" on, or only extreme edge cases like someone's hand-compiled version of some obscure browser on HURD for Itanium with an extension that blocks all third party cookies and half of the JavaScript APIs in the browser?
- ok_dad 3y agoI had issues using Apple private relay and an ad blocker on my iPhone, so this is probably the usual bullshit “we’re for the users!” then in reality it blocks anyone who doesn’t want to get fingerprinted. I’m not a fan.
- deleted 3y ago[deleted]
- andrewshadura 3y agoIt does.
- unleaded 3y agowhich one
- andrewshadura 3y agoIt does block users with no special settings.
- c420 3y agoI'm guessing this is why archive.ph and it's other url's are working now instead of the neverending captcha loop
- theamk 3y agoThose were never cloudfare's, they were just using similar colors. (You can tell easily because Cloudfare always puts their logo somewhere... and those captchas had none)
- omgmajk 3y agoOfT: I don't know what it is but I never get that site to load. Like I see people using it to archive things but I can never go there or read the links.
- mardifoufs 3y agoIt's because you are using CloudFlare DNS.
- orthecreedence 3y ago"We painted the barrel we bend you over when you try to read a website!!"
- oynqr 3y ago> We don’t rely on tracking user data, like what other websites someone has visited, to determine if a user is a human or robot. Doesn't this wording imply that they actually do collect this data, but just don't use it for the bot decision?
- dizhn 3y agoIt sounds neutral to me. They might well be collecting the data but I don't think the implication is there.
- andrewshadura 3y agoGreat, so you employ extreme levels of user fingerprinting, and privacy-focused users are left out and considered bots. Thank you very much :)
- stavros 3y agoHow would you recommend someone distinguish privacy-oriented users from bots?
- andrewshadura 3y agoJust don't.
- stavros 3y agoSo just remove access to the feature for everyone?
- colesantiago 3y ago> Just don't. So how would this work with financial websites like Stripe? Should they let bots open ready to use their service?
- danogentili 3y agoYes.
- colesantiago 3y agoGreat idea, let's tell Stripe, @pc, and all the financial companies to remove CAPTCHAs and hopefully automated fraud, card testing and disputes won't increase at all.
- ric2b 3y agoHave CAPTCHAs actually helped to solve or reduce automated fraud, card testing and disputes? Is there any evidence of that?
- hknmtt 3y agoCAPTCHA is pain in the ass. In a project I am working on, I have two forms I needed to protect - sign up and sign in. Sign up form does not do anything beside storing credentials in cache and waits for confirmation email link to be used. Sign in form uses various authentication methods but resource-wise, it will load user object and compare data at most. I decided to not use any captcha and let rate limiting do the heavy lifting if I get caught in some bot's eye. There really is no need for captcha because you can rate limit any page or form and once bot passes the threshold, nothing can happen since it is not a real user. All this captcha usage are remnants from a decade ago when all was new on the internet. But today, it's entirely archaic concept and serves only to mine personal data, just like all those "free" CDNs and fonts and whatnot that bigtech uses to literally map the entire internet.
- zigzag312 3y agoA few years ago I had a newsletter subscription form where one day some bot started subscribing with real email addresses. These real users started marking confirmation email as spam, which in turn affected domain reputation. I don't remember anymore if it used proxies with different IPs or not, but I added CAPTCHA fix this ... CAPTCHA for newsletter subscription...
- thenickdude 3y agoSame experience here, and I'm still baffled as to why they're doing this, do you have any guesses?
- neilv 3y agoHopefully this is an all-around improvement over the last year, and I'll see how it goes, but I've gotten a little concerned about all the blind dependence that a lot of sites now have on Cloudflare. For one reason, I recently spent months with Cloudflare blocking my Firefox ESR from many sites, including 2 key paid ones for work. When both companies showed zero interest in trying to figure out why Cloudflare was doing that, even if they lost a customer, I had the thought that this is probably what it's going to be like with a lot more things. We all know some of the key huge companies that do the math about how many users they're willing to lose/screw, to gain some other advantage or to reduce some cost. But Cloudflare might be one way that small companies will have no choice but to lose/screw users in an uncaring way, like they were those uncaring huge companies. That might hurt the companies eventually, but it will tend to hurt many users first. Fingers crossed that at least Cloudflare is rising to the challenge to not become a resented Kafkaesque institution.
- politelemon 3y agoWhile there are several new concerns brought about by this, which I agree with and are highlighted in other comments... I wanted to celebrate the good news part which is seeing fewer captchas. I hope other operators can follow suit and replace their solutions with something more universally human friendly. Browsing the web should not be a harrowing experience for the people it was made for. It's quite typical in our industry to churn something out quickly, which isn't always suitable, but sticks around for a very long time, before something better comes along. I hope captcha can be relegated to a historic footnote some day.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- gbraad 3y agoAnytime Turnstile is used, I experience seconds of slow-down on mobile devices using Vivaldi.
- Lucasoato 3y ago> We don’t rely on tracking user data, like what other websites someone has visited, to determine if a user is a human or robot. Our business is protecting websites, not selling ads, so operators can deploy Turnstile knowing that their users’ data is safe. In few lines they have positioned their product in a much more competitive way than Google reCAPTCHA, highlighting Google privacy pain point.
- traceroute66 3y ago> In few lines they have positioned their product in a much more competitive way than Google reCAPTCHA, highlighting Google privacy pain point. You do realise hCaptcha[1] is a thing, right ? Most privacy conscious websites switched from reCAPTCHA to hCaptcha years ago. [1]https://www.hcaptcha.com https://www.hcaptcha.com
- sylware 3y agoWait... finally noscript/basic (x)html proper support? That said, with my noscrit/basic (x)html browsers, I have not seen a cloudflare captcha in months. But... I stay alert, because that could come back in a whim.
- jbaber 3y agoThe infinite turnstile loop is a real hassle for me. I only spoof my user agent because multiple websites block me if I don't pretend firefox is chrome. Now it's spoof on for those sites, spoof off for turnstile sites. When the two intersect, I guess I'll have to install chromium or switch banks/cell provider/etc.
- 3np 3y agoWhatever happened to PrivacyPass? Is it effectively abandoned in favor of Turnstile?
- donatzsky 3y agoConsidering the potential issues with Turnstile, what are some good alternatives?
- injeolmi_love 3y agoIt’s good to see Cloudlfare finally admit that they have been blocking human users. I’m one of the people that gets the infinite reloading cycle that Cloudflare claimed can’t happen in previous hacker news threads. In this post they finally admit they have been blocking human users they didn’t know about before. Gaslighting over, hopefully?
- asah 3y agohow does this work for blind users using screen readers?
- lousken 3y agoI wrote multiple times to cloudflare about not being able to verify as human (especially on chatgpt) but with no success. Technology working as intended /s
- casenmgreen 3y agoI couldn't view the blog post. The "Just a moment" security check does not complete - sits there, with the busy icon, "Verifying". Using Tor Browser, which will be why. This is normal behaviour for Cloudflare sites. Making a new circuit sooner or later gets past the check, usually after between two and five retries. Curiously, I can never view Shopify sites. They always and fully block Tor.
- meibo 3y agoThat sucks, but it's also just a business decision. If 97%(I made that up, but I wouldn't be surprised if it was that high) of purchases through Tor are fraudulent, then it makes a lot of sense to just not allow it. Take your money elsewhere.
- harabat 3y agoThere was a report posted on HN months ago showing the proportion of fraudulent vs legitimate activities on Tor vs non-Tor across a pool of websites. Tor users were (slightly, IIRC) more likely to be malicious, but they represented a drop in the bucket against all malicious users. Maybe some sites that do block Tor might be seeing different proportions, I'd wager most of them do it because Tor == bad for most people. I'll add the source when I find it.
- usr1106 3y agoHas anybody checked what Turnstyle actually does?
- pvorb 3y agoCan anyone explain why Cloudflare thinks it's their job to force CAPTCHAs or "Turnstile" on users? Why is bot traffic so bad for them? And in case it's about preventing DDoS attacks, can't they wait for an actual attack until they activate the check for a site?
- deleted 3y ago[deleted]
- wlonkly 3y agoThat is a feature that they sell to their customers.
- highclass 3y agoAccording to https://developers.cloudflare.com/turnstile/ https://developers.cloudflare.com/turnstile/ A pay-as-you-go option for advanced features will be available in early 2024 for self-serve customers. Users can continue to access these advanced features below our 1 million siteverify request limit. So it seems it will be not so good for free users.
- super256 3y agoTurnstile is awful. When I use the steam web browser (ingame overlay) I get a permanent loop when trying to access bitskins.com with a search query.
- danShumway 3y agoThe normal response from privacy advocates to this bullcrap is to just complain about it and tell Cloudflare that they should do better. More and more I feel like we need to take a page from pirates and attackers and treat Cloudflare systems like Turnstile like what they are: malware that circumvents device control. And we should encourage people to break the systems and to come up with ways to fool the systems, we should encourage pooling information about clients in a way that makes it easier to lie to these checks and give them the responses to APIs that they expect to get. We need to stop treating this like it's a civil conversation and put more energy into decompiling and breaking Captchas and other attestation methods, and normalize the idea that breaking these systems is good and should be accessible to normal people. Because increasingly, breaking the systems is going to be the only way to run really privacy-focused software. It's like adblocking, you don't make progress by negotiating with advertisers, you block ads. We have no negotiating power with Cloudflare and no way to force companies to care about user privacy or freedom unless we have ways to circumvent these systems. ---- I'm tired of trying of entering into a relationship with Cloudflare where they break everything and we send them a bunch of bug reports begging to be let back in. Nah, we need to start decompiling their crap and circumventing it.
- icar 3y agoI'm surprised how many people have issues with Turnstile. I've never had one, and I use GrapheneOS + VPN / Linux + VPN. All Firefox.
- conquistadog 3y agoTurnstile fails spectacularly for me using the materialistic app to read HN articles. Not sure yet why.
- jeffalyanak 3y agoAre there any foss, self-hostable tools that can at least approach the effectiveness of cloudflare's various security and anti-ddos features? If there was a relatively turn-key solution that people could deploy it might help wean people off of cloudflare.
- sandstrom 3y agoAny plans for a pay-as-you-go (self-service) plan? I emailed you and asked you to take my money, but your sales team disqualified us because we wasn't big enough (reasonable, sales people are expensive). But I think many smaller firms would like to pay a fair price for it, and have more configurability (logo removal, etc).