3 ms·

I wonder how these hidden links interact with screen readers. The article says they only get served when Cloudflare already believes you're a bot, but due to my

I wonder how these hidden links interact with screen readers. The article says they only get served when Cloudflare already believes you're a bot, but due to my privacy settings and VPN, a lot of Cloudflare-fronted web pages think I'm a bot when I'm just browsing around the web. I suppose that having invisible links in the page wouldn't hurt me much, but would they bug someone using a screen reader? Honestly just wondering.

ericrallen 2y ago
Given the way accessibility is often an afterthought at best, this is a really good question. Would love to hear about some of the experiences that screen reader users and other folks who use assistive technology have with things like getting caught in the CloudFlare filters and other “human” verification systems. It seems easy to get caught in the net of “bot detection” as a normal user, and some of the verification steps don’t always seem very accessible.
- michaelbuckbee 2y ago
  Not quite what you're asking for, but Tor users have long complained that Cloudflare basically makes it unusable (asking for complicated captchas on each page of a site, etc.)
  - binaryturtle 2y ago
    I don't even use Tor, just an older Firefox. I'm no longer able to visit any site that uses that Cloudflare "human check". Once I whitelist Cloudflare in uBlock and reload to see the captcha the browser starts to busy-loop. Even closing the tab won't fix that. I have to hard kill the whole thing. I consider it straight malware whatever they do.
    - genewitch 2y ago
      I never let Firefox update when it wants to. I update it after Windows does so that everything breaks at the same time. I noticed that as my Firefox version gets two versions behind, I start hitting Cloudflare human test every single site I go to. Obnoxious. I like the extensions I have, thanks. It's my computer. It's the same fingerprint it was 5 minutes ago, and last week.
      - johnea 2y ago
        Sounds like it's finally time to abandon windows... All efforts to force users into ever newer versions of browsers are primarily motivated by goggle's ever increasing surveillance in each new version.
    - deleted 2y ago
      [deleted]
    - Rastonbury 2y ago
      Yeah for all the marketing speak on that page about machine learning bot detection, just a browser version and VPN is enough to induce a false positive
    - calvinmorrison 2y ago
      same problem. cant get into my bank, cant get into my email, stuck in redirect loops with gmail kicking me out, remember my device doesnt work. I love firefox for 15 + years... but i have to quit
ryukoposting 2y ago
I've had issues for years with several of Cloudflare's products making large chunks of the web worse than they need to be, or outright unusable. You bring up a very legitimate concern.
nnf 2y ago
> We also ensured that these links remain invisible to human visitors through carefully implemented attributes and styling. Additionally, I wonder how this works on sites with a Content Security Policy that disallows inline styles and style tags and stylesheets without a nonce. I suppose if Cloudflare is proxying your site, they could get the nonce from the content-security-policy header and use that, but hopefully that would be an opt-in-only behavior.
hoherd 2y ago
One thing they mention in the article is monitoring the behavior as the irrelevant labyrinth of data is navigated in order to generate improved bot detection algorithms. Since the data they are serving is irrelevant to the expected page content, it's unlikely that a human would navigate very far into the labyrinth. Also, it appears that it's not implemented through hidden links, but entirely different page content: > rather than blocking the request, we will link to a series of AI-generated pages that are convincing enough to entice a crawler to traverse them
- pests 2y ago
  I think your last quote is incorrect, at least partially. I'm not sure they replace the entire target page: > This pre-generated content is seamlessly integrated as hidden links on existing pages via our custom HTML transformation process, without disrupting the original structure or content of the page. > We also ensured that these links remain invisible to human visitors through carefully implemented attributes and styling. To further minimize the impact to regular visitors, we ensured that these links are presented only to suspected AI scrapers, while allowing legitimate users and verified crawlers to browse normally.
  - metadat 2y ago
    How does a crawler become verified and blessed by Cloudflare?
    - pests 2y ago
      I’m not involved with Cloudflare but IMO they probably calculate some score based on: honesty (not trying to hide user agent, etc), respecting robots.txt, proper crawl rate, etc.
  - hoherd 2y ago
    Good catch, I missed that part completely. I'm heading into a long airport layover so I should have time to reread the full article.

ericrallen 2y ago

Given the way accessibility is often an afterthought at best, this is a really good question. Would love to hear about some of the experiences that screen reader users and other folks who use assistive technology have with things like getting caught in the CloudFlare filters and other “human” verification systems. It seems easy to get caught in the net of “bot detection” as a normal user, and some of the verification steps don’t always seem very accessible.

michaelbuckbee 2y ago
Not quite what you're asking for, but Tor users have long complained that Cloudflare basically makes it unusable (asking for complicated captchas on each page of a site, etc.)
- binaryturtle 2y ago
  I don't even use Tor, just an older Firefox. I'm no longer able to visit any site that uses that Cloudflare "human check". Once I whitelist Cloudflare in uBlock and reload to see the captcha the browser starts to busy-loop. Even closing the tab won't fix that. I have to hard kill the whole thing. I consider it straight malware whatever they do.
  - genewitch 2y ago
    I never let Firefox update when it wants to. I update it after Windows does so that everything breaks at the same time. I noticed that as my Firefox version gets two versions behind, I start hitting Cloudflare human test every single site I go to. Obnoxious. I like the extensions I have, thanks. It's my computer. It's the same fingerprint it was 5 minutes ago, and last week.
    - johnea 2y ago
      Sounds like it's finally time to abandon windows... All efforts to force users into ever newer versions of browsers are primarily motivated by goggle's ever increasing surveillance in each new version.
  - deleted 2y ago
    [deleted]
  - Rastonbury 2y ago
    Yeah for all the marketing speak on that page about machine learning bot detection, just a browser version and VPN is enough to induce a false positive
  - calvinmorrison 2y ago
    same problem. cant get into my bank, cant get into my email, stuck in redirect loops with gmail kicking me out, remember my device doesnt work. I love firefox for 15 + years... but i have to quit

ryukoposting 2y ago

I've had issues for years with several of Cloudflare's products making large chunks of the web worse than they need to be, or outright unusable. You bring up a very legitimate concern.

nnf 2y ago

> We also ensured that these links remain invisible to human visitors through carefully implemented attributes and styling. Additionally, I wonder how this works on sites with a Content Security Policy that disallows inline styles and style tags and stylesheets without a nonce. I suppose if Cloudflare is proxying your site, they could get the nonce from the content-security-policy header and use that, but hopefully that would be an opt-in-only behavior.

hoherd 2y ago

One thing they mention in the article is monitoring the behavior as the irrelevant labyrinth of data is navigated in order to generate improved bot detection algorithms. Since the data they are serving is irrelevant to the expected page content, it's unlikely that a human would navigate very far into the labyrinth. Also, it appears that it's not implemented through hidden links, but entirely different page content: > rather than blocking the request, we will link to a series of AI-generated pages that are convincing enough to entice a crawler to traverse them

pests 2y ago
I think your last quote is incorrect, at least partially. I'm not sure they replace the entire target page: > This pre-generated content is seamlessly integrated as hidden links on existing pages via our custom HTML transformation process, without disrupting the original structure or content of the page. > We also ensured that these links remain invisible to human visitors through carefully implemented attributes and styling. To further minimize the impact to regular visitors, we ensured that these links are presented only to suspected AI scrapers, while allowing legitimate users and verified crawlers to browse normally.
- metadat 2y ago
  How does a crawler become verified and blessed by Cloudflare?
  - pests 2y ago
    I’m not involved with Cloudflare but IMO they probably calculate some score based on: honesty (not trying to hide user agent, etc), respecting robots.txt, proper crawl rate, etc.
- hoherd 2y ago
  Good catch, I missed that part completely. I'm heading into a long airport layover so I should have time to reread the full article.