4 ms·

How would you recommend avoiding invasive fingerprinting without being labeled as a bot?

by danShumway 3y ago

stavros 3y ago
I don't need to recommend anything, I'm not the one complaining about the existing solutions not being good.
- danShumway 3y ago
  Great, then we'll keep using Privacy Pass, picture/audio CAPTCHAs, and proof of work, since you think those existing solutions are good? ---- People have a tendency to lean into whatever outcome they want as if it's the default outcome that everyone else needs to disprove. But the reality is, Turnstile is a new system that is being newly developed as a response to changing conditions around traditional CAPTCHA methods, and it's not any privacy advocate's fault that robots now know how to do OCR. And "I don't need to figure out how to preserve your privacy" should give you some clarity into why privacy advocates are not very sympathetic when you say "well, we have to start doing fingerprinting now because the robots broke everything, what is the alternative?" Nah, we don't have to find you an alternative if you have no interest in actually working with us to meet everyone's needs equally. It stinks that robots broke your audio CAPTCHAs, but that's not Firefox's fault and it's not a privacy advocate's job to fix. Particularly not in the situation where you're unwilling to advocate for our needs alongside your own.
  - stavros 3y ago
    Where did I say they're good?
    - danShumway 3y ago
      > I'm not the one complaining about the existing solutions not being good. So you are complaining that the existing solutions aren't good? I mean, I'm perfectly fine sticking with existing CAPTCHA audio systems or proof of work. They're problematic but workable; over time we can push for systems like privacy pass that improve them for everyone. But if you want to propose that we go all-in on fingerprinting and capability testing, then what's your plan to mitigate the new privacy risks from that?
      - stavros 3y ago
        No. I'm not complaining either way. This is a summary of this thread: Cloudflare: Hey guys, we have a solution for telling humans and bots apart! Commenter: Your solution sucks! Me: What would you recommend? Commenter: Why don't you recommend something? etc etc.
        danShumway 3y ago
        > Me: What would you recommend? Right, and what I'm saying is that when a solution is proposed that stinks, it doesn't just magically get the default seal of approval, it doesn't suddenly become everyone else's problem to find an alternative. Clouflare is proposing a solution with a negative impact on privacy rights and user autonomy. And you're kind of jumping right to, "well, unless you can perfectly solve the problem then we'll go with what they propose." That's not really how solutions or negotiations or anything works. If your solution to "how do we distinguish bots" is that we'll stop caring about privacy, then I don't see why it's any less of a solution to say, "the way we'll preserve privacy is to stop caring about bots" -- other than that you've arbitrarily decided that the solution to this problem has to prioritize bot filtering over privacy. The situation we're in is that CAPTCHAs are easier to defeat now than they used to be. Cloudflare is proposing that we get rid of privacy rights and user autonomy to solve that problem. The rest of us are saying, "sorry, it's a nice idea but privacy rights are non-negotiable." It is not our responsibility to solve Cloudflare's problem, it is Cloudflare's responsibility to come up with a solution that isn't terrible. They're the ones who are saying that existing CAPTCHAs aren't good enough anymore, privacy advocates are fine sticking with status quo.
        stavros 3y ago
        No, I'm saying "'your solution sucks' isn't constructive criticism". There are many solutions you can choose from, and you're welcome to choose any of them. The fact that this has privacy issues doesn't invalidate it as a solution, it just makes it unsuitable for people who want privacy. Those people will choose something else. It's not Cloudflare's responsibility to do anything, really. They could just as well not have released this. As a service owner, I want to be able to distinguish legitimate users from bots. If I can't do that, there's a real possibility that I will stop offering a subset of my service. If someone can find a privacy-preserving solution to distinguishing legitimate users and bots, amazing, but, until then, users will have to choose between the existing solutions and not accessing my service at all. I don't see how this could be any other way, and complaining about Cloudflare's implementation of a CAPTCHA doesn't do anything constructive, as far as I can see. The problem still remains, and no amount of "your solution isn't good, do better" is helping.

How would you recommend avoiding invasive fingerprinting without being labeled as a bot?

stavros 3y ago

I don't need to recommend anything, I'm not the one complaining about the existing solutions not being good.

danShumway 3y ago
Great, then we'll keep using Privacy Pass, picture/audio CAPTCHAs, and proof of work, since you think those existing solutions are good? ---- People have a tendency to lean into whatever outcome they want as if it's the default outcome that everyone else needs to disprove. But the reality is, Turnstile is a new system that is being newly developed as a response to changing conditions around traditional CAPTCHA methods, and it's not any privacy advocate's fault that robots now know how to do OCR. And "I don't need to figure out how to preserve your privacy" should give you some clarity into why privacy advocates are not very sympathetic when you say "well, we have to start doing fingerprinting now because the robots broke everything, what is the alternative?" Nah, we don't have to find you an alternative if you have no interest in actually working with us to meet everyone's needs equally. It stinks that robots broke your audio CAPTCHAs, but that's not Firefox's fault and it's not a privacy advocate's job to fix. Particularly not in the situation where you're unwilling to advocate for our needs alongside your own.
- stavros 3y ago
  Where did I say they're good?
  - danShumway 3y ago
    > I'm not the one complaining about the existing solutions not being good. So you are complaining that the existing solutions aren't good? I mean, I'm perfectly fine sticking with existing CAPTCHA audio systems or proof of work. They're problematic but workable; over time we can push for systems like privacy pass that improve them for everyone. But if you want to propose that we go all-in on fingerprinting and capability testing, then what's your plan to mitigate the new privacy risks from that?
    - stavros 3y ago
      No. I'm not complaining either way. This is a summary of this thread: Cloudflare: Hey guys, we have a solution for telling humans and bots apart! Commenter: Your solution sucks! Me: What would you recommend? Commenter: Why don't you recommend something? etc etc.
      - danShumway 3y ago
        > Me: What would you recommend? Right, and what I'm saying is that when a solution is proposed that stinks, it doesn't just magically get the default seal of approval, it doesn't suddenly become everyone else's problem to find an alternative. Clouflare is proposing a solution with a negative impact on privacy rights and user autonomy. And you're kind of jumping right to, "well, unless you can perfectly solve the problem then we'll go with what they propose." That's not really how solutions or negotiations or anything works. If your solution to "how do we distinguish bots" is that we'll stop caring about privacy, then I don't see why it's any less of a solution to say, "the way we'll preserve privacy is to stop caring about bots" -- other than that you've arbitrarily decided that the solution to this problem has to prioritize bot filtering over privacy. The situation we're in is that CAPTCHAs are easier to defeat now than they used to be. Cloudflare is proposing that we get rid of privacy rights and user autonomy to solve that problem. The rest of us are saying, "sorry, it's a nice idea but privacy rights are non-negotiable." It is not our responsibility to solve Cloudflare's problem, it is Cloudflare's responsibility to come up with a solution that isn't terrible. They're the ones who are saying that existing CAPTCHAs aren't good enough anymore, privacy advocates are fine sticking with status quo.
        stavros 3y ago
        No, I'm saying "'your solution sucks' isn't constructive criticism". There are many solutions you can choose from, and you're welcome to choose any of them. The fact that this has privacy issues doesn't invalidate it as a solution, it just makes it unsuitable for people who want privacy. Those people will choose something else. It's not Cloudflare's responsibility to do anything, really. They could just as well not have released this. As a service owner, I want to be able to distinguish legitimate users from bots. If I can't do that, there's a real possibility that I will stop offering a subset of my service. If someone can find a privacy-preserving solution to distinguishing legitimate users and bots, amazing, but, until then, users will have to choose between the existing solutions and not accessing my service at all. I don't see how this could be any other way, and complaining about Cloudflare's implementation of a CAPTCHA doesn't do anything constructive, as far as I can see. The problem still remains, and no amount of "your solution isn't good, do better" is helping.