6 ms·

> Second, we find that a few privacy-focused users often ask their browsers to go beyond standard practices to preserve their anonymity. This includes changing

by yuumei 3y ago

> Second, we find that a few privacy-focused users often ask their browsers to go beyond standard practices to preserve their anonymity. This includes changing their user-agent > those users can immediately understand the issue and make a conscientious choice about whether they want to allow their browser to pass a challenge. So they will block privacy-focused users. I guess VPNs will be blocked too. It seems they have just removed the captcha part of their system and are spinning it as a good thing to block certain users.

qsi 3y ago
I am curious to see how this works in practice. When I went to their Turnstile sign-up page [0], that is itself protected, I had no problems passing the test despite a slew of privacy-focused features enabled in my browser. [0] https://dash.cloudflare.com/sign-up?to=/:account/turnstile https://dash.cloudflare.com/sign-up?to=/:account/turnstile
- zh3 3y ago
  Interestingly, although my Firefox ESR passed the test, that page immediately made my laptop's fan spin up (normally only does that on media-heavy pages) - possibly thr "proof of work" test they mention in the article?
  - OJFord 3y ago
    I find that happens with canvas/webGL blocked on pages which try to use it.
- justinclift 3y ago
  Testing that link just now with Tor, it seemed to pass their checks ok. Hopefully blocking Tor users will mostly be a thing of the past... :)
- Bu9818 3y ago
  The captcha on this page takes a few seconds then says "Failure", with no message, then restarts itself, when using Tor Browser on the Safer mode. edit: Was able to get a mix of a few successes and a few failures upon multiple browser restarts. Maybe I was lucky to avoid a discriminated exit node? I'm not sure if IP address is a factor here.
mikae1 3y ago
Whenever one of those Turnstile checkboxes show up I'm unable to get past it. It's been that way on most of my computers for over a year. I check it and it just reloads with a blank checkbox again. It's an eternal loop of death. My Firefox installations are not even Arkenfoxed. I just use couple of privacy oriented add-ons and a few about:config tweaks. Cloudflare verifications are destroying the web.
- sneak 3y ago
  Not really. Website operators should absolutely be able to refuse service to anyone on any grounds.
  - zelphirkalt 3y ago
    Only that most website operators are not in the know about the issues they will cause, if the use cloudflare or any third party hosting that in turn makes use of cloudflare.
  - mikae1 3y ago
    Yes. Not sure that these checks are always the result of a conscious choice though. They just come with the Cloudflare package. I wonder what percentage of collateral damage they're expecting. I know I'm not alone. They're saying 15% of people don't even attempt to complete the captchas. I wonder how many false positives are they getting with Turnstile. Hopefully less than 15%…
    - jdright 3y ago
      The thing is, with captchas I can retry 2, 3..5 times before giving up. This thing here just doesn't work and I can't do anything.
  - december456 3y ago
    I wonder how many site operators are aware of the underlying issue with leasing your site to CF, how much false positives and false negatives Cloudflare has, and if there are any alternatives.
zbrozek 3y ago
Trying to get past their captchas was futile anyway, so just being blocked without a false sense of hope is an improvement. I learned to make no attempt on them and to just close the tab immediately.
danShumway 3y ago
> and make a conscientious choice about whether they want to allow their browser to pass a challenge. I don't know how to vocalize this exactly, but this wording really gets under my skin. It shifts the entire responsibility of being blocked over to the user; it's not Cloudflare blocking privacy configs from browsers, it's not Cloudflare circumventing the notion that user agents have agency to present how they want, it's not Cloudflare blocking people from changing their user-agents: no, it's the user who just decided that they don't want their browser to pass the challenge. It also trivializes the impact, there's something about this phrasing that's like: "oh, it's no big deal, some users have just decided they don't want to allow their browser to pass a challenge." I am not the person who decides whether or not my browser passes a check that Cloudflare invented. Phrasing it this way has some real, "everyone has a choice whether to give me their wallet, but people also have the freedom to decide whether or not they're going to allow me let them go without shooting them" vibes. Bullcrap. And this is a huge deviation away from the idea of purely clientside checks like Privacy Pass (not that those methods are perfect, but they were at least headed somewhat in the right direction). Cloudflare is basically admitting that they are going to focus on verifying hardware and restricting software configurations, and they want to phrase it like a good thing. It's soft DRM because they can't go all-in on hardware attestation yet, Cloudflare is openly saying, "we're going to restrict hardware categories and software from accessing the Open Internet." Oh sorry, I should rephrase that. They're going to give users the power to decide whether or not they want their devices they own to be allowed by Cloudflare to access the Open web.

by yuumei 3y ago

qsi 3y ago

I am curious to see how this works in practice. When I went to their Turnstile sign-up page [0], that is itself protected, I had no problems passing the test despite a slew of privacy-focused features enabled in my browser. [0] https://dash.cloudflare.com/sign-up?to=/:account/turnstile https://dash.cloudflare.com/sign-up?to=/:account/turnstile

zh3 3y ago
Interestingly, although my Firefox ESR passed the test, that page immediately made my laptop's fan spin up (normally only does that on media-heavy pages) - possibly thr "proof of work" test they mention in the article?
- OJFord 3y ago
  I find that happens with canvas/webGL blocked on pages which try to use it.
justinclift 3y ago
Testing that link just now with Tor, it seemed to pass their checks ok. Hopefully blocking Tor users will mostly be a thing of the past... :)
Bu9818 3y ago
The captcha on this page takes a few seconds then says "Failure", with no message, then restarts itself, when using Tor Browser on the Safer mode. edit: Was able to get a mix of a few successes and a few failures upon multiple browser restarts. Maybe I was lucky to avoid a discriminated exit node? I'm not sure if IP address is a factor here.

mikae1 3y ago

Whenever one of those Turnstile checkboxes show up I'm unable to get past it. It's been that way on most of my computers for over a year. I check it and it just reloads with a blank checkbox again. It's an eternal loop of death. My Firefox installations are not even Arkenfoxed. I just use couple of privacy oriented add-ons and a few about:config tweaks. Cloudflare verifications are destroying the web.

sneak 3y ago
Not really. Website operators should absolutely be able to refuse service to anyone on any grounds.
- zelphirkalt 3y ago
  Only that most website operators are not in the know about the issues they will cause, if the use cloudflare or any third party hosting that in turn makes use of cloudflare.
- mikae1 3y ago
  Yes. Not sure that these checks are always the result of a conscious choice though. They just come with the Cloudflare package. I wonder what percentage of collateral damage they're expecting. I know I'm not alone. They're saying 15% of people don't even attempt to complete the captchas. I wonder how many false positives are they getting with Turnstile. Hopefully less than 15%…
  - jdright 3y ago
    The thing is, with captchas I can retry 2, 3..5 times before giving up. This thing here just doesn't work and I can't do anything.
- december456 3y ago
  I wonder how many site operators are aware of the underlying issue with leasing your site to CF, how much false positives and false negatives Cloudflare has, and if there are any alternatives.

zbrozek 3y ago

Trying to get past their captchas was futile anyway, so just being blocked without a false sense of hope is an improvement. I learned to make no attempt on them and to just close the tab immediately.

danShumway 3y ago

> and make a conscientious choice about whether they want to allow their browser to pass a challenge. I don't know how to vocalize this exactly, but this wording really gets under my skin. It shifts the entire responsibility of being blocked over to the user; it's not Cloudflare blocking privacy configs from browsers, it's not Cloudflare circumventing the notion that user agents have agency to present how they want, it's not Cloudflare blocking people from changing their user-agents: no, it's the user who just decided that they don't want their browser to pass the challenge. It also trivializes the impact, there's something about this phrasing that's like: "oh, it's no big deal, some users have just decided they don't want to allow their browser to pass a challenge." I am not the person who decides whether or not my browser passes a check that Cloudflare invented. Phrasing it this way has some real, "everyone has a choice whether to give me their wallet, but people also have the freedom to decide whether or not they're going to allow me let them go without shooting them" vibes. Bullcrap. And this is a huge deviation away from the idea of purely clientside checks like Privacy Pass (not that those methods are perfect, but they were at least headed somewhat in the right direction). Cloudflare is basically admitting that they are going to focus on verifying hardware and restricting software configurations, and they want to phrase it like a good thing. It's soft DRM because they can't go all-in on hardware attestation yet, Cloudflare is openly saying, "we're going to restrict hardware categories and software from accessing the Open Internet." Oh sorry, I should rephrase that. They're going to give users the power to decide whether or not they want their devices they own to be allowed by Cloudflare to access the Open web.