3 ms·

Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops. My ISP regularly changes everyo

Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops. My ISP regularly changes everyone's IP, and I apparently share an ISP with people who suck, so I get flagged just trying to do all sorts of normal things. Some examples: - I've never bought anything from Etsy but I'm somehow banned from even viewing their site at all. - Discord immediately bans me any time I try to create an account. - Can't buy flights from Delta, always gives a non-descript error. - Can't buy concert tickets, it thinks I'm a fraudulent buyer. - Most CF sites produce a "Sorry, you have been blocked" page, or just loop. - Trying to buy products on a shopping cart will have my order silently flagged/canceled for "VPN usage" (I don't use one). - Some sites/programs block me for being on the DroneBL or similar lists I did nothing to get onto, and have verified many times that it's not really coming from me. I just take my business elsewhere... eventually I'll probably just stop using technology at all.

chrisjj 6mo ago
> I just take my business elsewhere... Mars? /i
prism56 6mo ago
Oh man I feel you. I turn my VPN off on certain sites due to the captcha loop.
Milpotel 6mo ago
Wouldn't a 1£ Linux VM as Wireguard access point suffice?
- ranger_danger 6mo ago
  Nope, I have tried. Just as suspicious to them if not moreso because it's a datacenter IP and not residential. I even have a list of sites I've tried to visit that were explicitly blocked from datacenter IPs, and that file has over a hundred hosts in it now.
ck2 6mo ago
whenever I can't access a website for various stupid blocks I fire up cloudflare warp and walk right through it use wireguard with wgcf in environments without cloudflare client yeah it's stupid we have to do this in 2026 but I guess cloudflare is the new AOL garden
- wafflemaker 6mo ago
  You sir seem to have solved a problem many people here have. Would you care to elaborate a little on how you did it? It doesn't happen that often to me, but sometimes adblock setup I'm using results in such issues.
  - tardedmeme 6mo ago
    He just told you, he used cloudflare WARP. It's a "VPN" along the lines of NordVPN et al, but by cloudflare, so it gets special treatment by cloudflare's walled garden enforcement system.
    - krackers 6mo ago
      I wonder if iCloud private relay might also work. Apple probably negotiated some special treatment
      - donmcronald 6mo ago
        I’m guessing it’s all the same effect as CGNAT exit IPs. You need to get big enough to be unblockable. That’s why everyone is trying to get in on the VPN game. This new reCAPTCHA setup is probably a good indicator that big tech wants to shift to verified access only. Personally, I’m just going to quit spending money via the internet and go back to piracy + retail stores with a physical location.
- titularcomment 6mo ago
  the fact that this works, as well as cloudflare having a literal web scraping tool available as another product honestly makes my blood boil.
Jigsy 6mo ago
> Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops. I had this problem recently with the Indeed website. (Cloudflare Captcha) Thanks to someone on Reddit, it was discovered that anyone using a Chromium based browser (Brave, Vivaldi, etc.) on Linux was being punished. Awfully frustrating having to set up a Virtual Machine just to be able to access one website via Firefox since even my hardened Firefox was being punished.
- anonymousiam 6mo ago
  Why not just change your user agent string?
  - tardedmeme 6mo ago
    It probably fingerprints the browser via TLS fingerprinting.
  - mschuster91 6mo ago
    That's useless, in fact it makes you stand out even more. There are SDKs that can differentiate based on an awful lot of signals if your user agent corresponds to your actual browser version.
  - codedokode 6mo ago
    Because the site can compare the user agent with navigator.platform, which your browser fills with great care.
    - userbinator 6mo ago
      That naturally implies we must patch the browser. "Source code? We don't need no stinkin' source code!"
      - codedokode 6mo ago
        That's what Russian underground hackers do to create so called "anti-detect" browsers, which can emulate different browser fingerprints. But they are commercial and closed-source.
hysan 6mo ago
Turnstile feels bad as a user. Every site that I’ve seen it long will lock up Safari hard while it’s doing whatever it’s doing. But at least I haven’t run into more than 2 refresh loops.
miladyincontrol 6mo ago
Almost would bet one or a few of your ISP's customers have their connections being used as residential VPNs. I know people like to think of suspicious android box setups but even a lot of "free" apps, extensions and other such services scarily seem to do that duty these days. I'm sure I'm preaching to the choir here, but its sad how many people will use some free of cost vpn and not even think why that might be.
- ranger_danger 6mo ago
  Yes, I have even seen mobile android games that include notices about a BrightData SDK or HolaVPN etc. where their idle bandwidth is resold.
  - donmcronald 6mo ago
    Does the app function as a proxy? I always assumed that wasn’t possible.
    - ranger_danger 6mo ago
      Why wouldn't it be possible? As long as background network access is allowed (the default).
- chadgpt2 6mo ago
  Honest question: Is there anything scary about this apart from lowering your ISP's reputation score?
  - donmcronald 6mo ago
    Yes. What if your connection is used for illegal activity?
retired 6mo ago
I have not been able to visit AliExpress for months now. Just an endless reCAPTCHA loop. I wonder if they are seeing a decrease in traffic and somehow find that acceptable.
rescbr 6mo ago
This is why I ended up paying extra for a static IP from my ISP. While they always provided me with a public IP outside a CGNAT, I guess whole IP blocks were being targeted by these web security providers. I guess my ISP allocates static IPs from a separate pool, and probably my IP block neighbors are better behaved (probably SMBs and other fellow nerds), aside from platforms learning that my IP is safe. Captcha difficulties are way down now.
wraptile 6mo ago
It's not only IP but entire browser stack is being fingerprinted: Javascript, http, tls - everything. I've been living in the SEA region on Linux firefox for the last 10 years and the web has been miserable due to cloudflare and recaptcha
- ranger_danger 6mo ago
  Yep I often have to launch a clean/ephemeral chromium profile just to access a specific website, but even then it's sometimes not enough.

chrisjj 6mo ago

> I just take my business elsewhere... Mars? /i

prism56 6mo ago

Oh man I feel you. I turn my VPN off on certain sites due to the captcha loop.

Milpotel 6mo ago

Wouldn't a 1£ Linux VM as Wireguard access point suffice?

ranger_danger 6mo ago
Nope, I have tried. Just as suspicious to them if not moreso because it's a datacenter IP and not residential. I even have a list of sites I've tried to visit that were explicitly blocked from datacenter IPs, and that file has over a hundred hosts in it now.

ck2 6mo ago

whenever I can't access a website for various stupid blocks I fire up cloudflare warp and walk right through it use wireguard with wgcf in environments without cloudflare client yeah it's stupid we have to do this in 2026 but I guess cloudflare is the new AOL garden

wafflemaker 6mo ago
You sir seem to have solved a problem many people here have. Would you care to elaborate a little on how you did it? It doesn't happen that often to me, but sometimes adblock setup I'm using results in such issues.
- tardedmeme 6mo ago
  He just told you, he used cloudflare WARP. It's a "VPN" along the lines of NordVPN et al, but by cloudflare, so it gets special treatment by cloudflare's walled garden enforcement system.
  - krackers 6mo ago
    I wonder if iCloud private relay might also work. Apple probably negotiated some special treatment
    - donmcronald 6mo ago
      I’m guessing it’s all the same effect as CGNAT exit IPs. You need to get big enough to be unblockable. That’s why everyone is trying to get in on the VPN game. This new reCAPTCHA setup is probably a good indicator that big tech wants to shift to verified access only. Personally, I’m just going to quit spending money via the internet and go back to piracy + retail stores with a physical location.
titularcomment 6mo ago
the fact that this works, as well as cloudflare having a literal web scraping tool available as another product honestly makes my blood boil.

Jigsy 6mo ago

> Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops. I had this problem recently with the Indeed website. (Cloudflare Captcha) Thanks to someone on Reddit, it was discovered that anyone using a Chromium based browser (Brave, Vivaldi, etc.) on Linux was being punished. Awfully frustrating having to set up a Virtual Machine just to be able to access one website via Firefox since even my hardened Firefox was being punished.

anonymousiam 6mo ago
Why not just change your user agent string?
- tardedmeme 6mo ago
  It probably fingerprints the browser via TLS fingerprinting.
- mschuster91 6mo ago
  That's useless, in fact it makes you stand out even more. There are SDKs that can differentiate based on an awful lot of signals if your user agent corresponds to your actual browser version.
- codedokode 6mo ago
  Because the site can compare the user agent with navigator.platform, which your browser fills with great care.
  - userbinator 6mo ago
    That naturally implies we must patch the browser. "Source code? We don't need no stinkin' source code!"
    - codedokode 6mo ago
      That's what Russian underground hackers do to create so called "anti-detect" browsers, which can emulate different browser fingerprints. But they are commercial and closed-source.

hysan 6mo ago

Turnstile feels bad as a user. Every site that I’ve seen it long will lock up Safari hard while it’s doing whatever it’s doing. But at least I haven’t run into more than 2 refresh loops.

miladyincontrol 6mo ago

Almost would bet one or a few of your ISP's customers have their connections being used as residential VPNs. I know people like to think of suspicious android box setups but even a lot of "free" apps, extensions and other such services scarily seem to do that duty these days. I'm sure I'm preaching to the choir here, but its sad how many people will use some free of cost vpn and not even think why that might be.

ranger_danger 6mo ago
Yes, I have even seen mobile android games that include notices about a BrightData SDK or HolaVPN etc. where their idle bandwidth is resold.
- donmcronald 6mo ago
  Does the app function as a proxy? I always assumed that wasn’t possible.
  - ranger_danger 6mo ago
    Why wouldn't it be possible? As long as background network access is allowed (the default).
chadgpt2 6mo ago
Honest question: Is there anything scary about this apart from lowering your ISP's reputation score?
- donmcronald 6mo ago
  Yes. What if your connection is used for illegal activity?

retired 6mo ago

I have not been able to visit AliExpress for months now. Just an endless reCAPTCHA loop. I wonder if they are seeing a decrease in traffic and somehow find that acceptable.

rescbr 6mo ago

This is why I ended up paying extra for a static IP from my ISP. While they always provided me with a public IP outside a CGNAT, I guess whole IP blocks were being targeted by these web security providers. I guess my ISP allocates static IPs from a separate pool, and probably my IP block neighbors are better behaved (probably SMBs and other fellow nerds), aside from platforms learning that my IP is safe. Captcha difficulties are way down now.

wraptile 6mo ago

It's not only IP but entire browser stack is being fingerprinted: Javascript, http, tls - everything. I've been living in the SEA region on Linux firefox for the last 10 years and the web has been miserable due to cloudflare and recaptcha

ranger_danger 6mo ago
Yep I often have to launch a clean/ephemeral chromium profile just to access a specific website, but even then it's sometimes not enough.