9 ms·
Great, so you employ extreme levels of user fingerprinting, and privacy-focused users are left out and considered bots. Thank you very much :)
by andrewshadura 3y ago
Great, so you employ extreme levels of user fingerprinting, and privacy-focused users are left out and considered bots. Thank you very much :)
- stavros 3y agoHow would you recommend someone distinguish privacy-oriented users from bots?
- andrewshadura 3y agoJust don't.
- stavros 3y agoSo just remove access to the feature for everyone?
- colesantiago 3y ago> Just don't. So how would this work with financial websites like Stripe? Should they let bots open ready to use their service?
- danogentili 3y agoYes.
- colesantiago 3y agoGreat idea, let's tell Stripe, @pc, and all the financial companies to remove CAPTCHAs and hopefully automated fraud, card testing and disputes won't increase at all.
- ric2b 3y agoHave CAPTCHAs actually helped to solve or reduce automated fraud, card testing and disputes? Is there any evidence of that?
- colesantiago 3y agohttps://stripe.com/gb/guides/state-of-online-fraud https://stripe.com/gb/guides/state-of-online-fraud
- userbinator 3y agoRate limits.
- stavros 3y agoBotnets.
- danShumway 3y agoIf you're worried about botnets, Cloudflare's solution won't save you either because normal unmodified browsers can be automated through extensions or remote debugging just fine. Headless Chromium with some tweaks is already good enough that it's practically impossible to distinguish from regular Chromium, and Google knows it. That's why they were pushing for WEI (even though they were claiming it wouldn't impact browser extensions or debugging protocols). Google knows that environment browser/fingerprinting isn't an effective solution to stop automated requests, because normal user browsers out of the box allow sending automated requests. Basically the only reason why botters don't already run full browsers is because of computer power, and botnets get around that problem. When attacks aren't limited by IP or compute power, attackers can just run regular browsers and bypass all of these checks. Even that isn't always necessary, a Raspberry Pi 5 is going to be perfectly capable of running a full Chrome instance to send automated requests through. At least IP rate limits require actual work to circumvent, you need to acquire a botnet or a lot of IPs. Browser capability testing is comparatively easier to get around, you just run a full browser.
- lionkor 3y agoIn what world do bots run firefox with adblocker? Surely a bot would pretend to be the most average US chrome user
- stavros 3y agoBots pretend to be whatever works.
- danShumway 3y agoHow would you recommend avoiding invasive fingerprinting without being labeled as a bot?
- stavros 3y agoI don't need to recommend anything, I'm not the one complaining about the existing solutions not being good.
- danShumway 3y agoGreat, then we'll keep using Privacy Pass, picture/audio CAPTCHAs, and proof of work, since you think those existing solutions are good? ---- People have a tendency to lean into whatever outcome they want as if it's the default outcome that everyone else needs to disprove. But the reality is, Turnstile is a new system that is being newly developed as a response to changing conditions around traditional CAPTCHA methods, and it's not any privacy advocate's fault that robots now know how to do OCR. And "I don't need to figure out how to preserve your privacy" should give you some clarity into why privacy advocates are not very sympathetic when you say "well, we have to start doing fingerprinting now because the robots broke everything, what is the alternative?" Nah, we don't have to find you an alternative if you have no interest in actually working with us to meet everyone's needs equally. It stinks that robots broke your audio CAPTCHAs, but that's not Firefox's fault and it's not a privacy advocate's job to fix. Particularly not in the situation where you're unwilling to advocate for our needs alongside your own.
- stavros 3y agoWhere did I say they're good?
- danShumway 3y ago> I'm not the one complaining about the existing solutions not being good. So you are complaining that the existing solutions aren't good? I mean, I'm perfectly fine sticking with existing CAPTCHA audio systems or proof of work. They're problematic but workable; over time we can push for systems like privacy pass that improve them for everyone. But if you want to propose that we go all-in on fingerprinting and capability testing, then what's your plan to mitigate the new privacy risks from that?