11 ms·

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while

Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecologically a nightmare), probably fingerprinting is the way to go - completely destroying the privacy of everyone involved. Cromite, a privacy conscious fork of Chromium for Android, has constantly issues with CloudFlare Turnstile [2] because they (Cloudflare) try to fingerprint it in multiple ways in order to pass the challenge. The only way to get it to work would be to join the CloudFlare Browser Developer program - which requires signing an NDA. Rightfully so, the project maintainer didn't want to do it. If you want to see the extent of what CloudFlare does to fingerprint the browsers, just have a look in the issue [2] and see which flags need to be disabled in order to allow CloudFlare to pass the challenge. I understand both sides, but at least CloudFlare could be flexible enough to fall back to PoW instead of just blocking people from sending forms or accessing websites... [1]: https://github.com/Danny-Dasilva/CycleTLS https://github.com/Danny-Dasilva/CycleTLS [2]: https://github.com/uazo/cromite/issues/2365 https://github.com/uazo/cromite/issues/2365

PearlRiver 5mo ago
This is why I have two separate browsers. If you want to do official stuff like paying for things you need to get through cloudflare.
- helterskelter 5mo ago
  Firefox added profile switching recently. Works good. (That said, I still keep separate machines. One for doing "official" things, the other for everything else)
  - b65e8bee43c2ed0 5mo ago
    >Works good. does it? same binary, same machine, same display, same 781 other heuristics.
  - ajb 5mo ago
    Odd - they've had that for years, but only on the command line. Wonder if it's different under the hood? They also have firefox containers which also never quite became a first-class feature (you have to install a plugin).
    - deleted 5mo ago
      [deleted]
  - notafox 5mo ago
    > Firefox added profile switching recently. I think this was as recent as 25 years ago? Recently they added some new UI. There was and still is (I think) classic Profile Manager UI, which you can launch with ./firefox -ProfileManager or access UI in about:profiles. But you don't have to use any of those anyway - see my comment above (a response to parent).
    - opem 5mo ago
      They actually have at least 3 kinds of profile: 1. containers - As they say its somekind of sandbox, technically a profile 2. profiles that are accesible through about:proflies, which they had for years, and probably the one you are talking about... 3. New profiles that comes with a pop-up much like how chromium browsers shows it
    - thayne 5mo ago
      The old UI was pretty difficult to use, and hard to discover unless you knew where to look though.
      - zelphirkalt 5mo ago
        What about the old UI is difficult to use? I am assuming you are talking about the profile manager.
- notafox 5mo ago
  You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles. Firefox with a non-default profile can be created like that: ./firefox -CreateProfile "profile-name /home/user/.mozilla/firefox/profile-dir/" # For, say, cloudflare that would be: ./firefox -CreateProfile "cloudflare /home/user/.mozilla/firefox/cloudflare/" And you can launch it like that: ./firefox -profile "/home/user/.mozilla/firefox/profile-dir/" # For cloudflare that would be: ./firefox -profile "/home/user/.mozilla/firefox/cloudflare/" So, given that /usr/bin/firefox is just a shell script, you can - create a copy of it, say, /usr/bin/firefox-cloudflare - adjust the relevant line, adding the -profile argument If you use an icon to run firefox (say, /usr/share/applications/firefox.desktop), you'll need to do copy/adjust line for the icon. Of course, "./firefox" from examples above should be replaced with the actual path to executable. For default installation of Firefox the path would be in /usr/bin/firefox script. So, you can have a separate profiles for something sensitive/invasive (linkedin, cloudflare, shops, banks, etc.) and then you can have a separate profile for everything else. And each profile can have its own set of extensions.
  - ferfumarma 5mo ago
    Except that fingerprinting means that both profiles are actually tied together by cloudflare (and other tech companies)
    - VoidWhisperer 5mo ago
      I think the idea is that they have the functionality that cloudflare is using to generate the fingerprint (like webGL in this case) disabled in their non-cloudflare profile and only use the cloudflare profile to do things they have to that are behind cloudflare
    - ranger_danger 5mo ago
      that's why I use completely different browsers with different settings. my CF-friendly one (not my daily driver) is `firejail --private chromium` so it always starts with a clean temporary profile
  - 5mo ago
b65e8bee43c2ed0 5mo ago
it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.
- ACCount37 5mo ago
  At the same time: it sure works well enough to annoy anyone with a "bad ASN" IP with 80 captchas a day.
  - shideneyu 5mo ago
    exactly that's what I was thinking... like the day they provided a solution to the issue they posed
  - marysol5 5mo ago
    It's how I remember I've left my VPN on
- mootothemax 5mo ago
  Exactly. I’m constantly amazed at how little you actually need to bypass CF, Amazon, Azure WAFs and so on (Incapsula springs to mind too). When you look at the code you’ve come up with, it’s actually quite small and compact. More to the point, these systems actually help scraping because proof of work unlocks essentially unlimited scraping, in my experience. That said - from my experience on the other side, sure you can’t stop people like me or you, but you can stop 99% of the others. That’s more than worth it operationally.
  - Chris2048 5mo ago
    What do you mean by ~"PoW unlocks unlimited scraping"?
    - danielheath 5mo ago
petu 5mo ago
> but unless you do PoW (which is also ecologically a nightmare) Can you expand? I don't see a problem with some napkin math. 5W load for 2 seconds is 0.002Wh (we have to let smartphones pass and not by doing PoW for 10s of seconds). 8 billion checks a day for a year = 8GWh.
- denysvitali 5mo ago
  I stand corrected. It's not a nightmare scenario (as for Bitcoins) - but I'm still of the idea that "useless" computations should be avoided (as we should avoid having 10MB websites). In any case, according to some napkin math done by Kimi 2.6 (which by itself is probably already consuming more than all of my PoW challenges for the upcoming 5 years) - the situation looks incredibly in favor of PoW: https://www.kimi.com/share/19e7ef40-a432-8912-8000-0000b4a714cf https://www.kimi.com/share/19e7ef40-a432-8912-8000-0000b4a71... Which makes me wonder why CloudFlare isn't switching to this already
  - dcrazy 5mo ago
    Because it doesn’t solve the problem of residential botnets.
    - dotancohen 5mo ago
      Neither does fingerprinting.
      - dcrazy 5mo ago
        The goal of Cloudflare’s fingerprinting is to detect whether a user agent appears to be a legitimate human. It’s not to identify human users across websites.
        zzo38computer 5mo ago
        That is not a good excuse for requiring overly complicated and overly specific software.
jwr 5mo ago
> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.
- denysvitali 5mo ago
  They sometimes have to comply with legal requests (which I understand), but at the same time they have a huge market share - which means that the internet is becoming less and less decentralized and more in their control. We've seen the effects of that in previous outages...
- stackghost 5mo ago
  >I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever. I think the Web is on its last legs, anyway. Generative AI and LLM-instead-of-search has destroyed what little value remained.
  - matheusmoreira 5mo ago
    Governments too. It's inevitable that the international network will fracture into multiple national networks with heavy filtering at the borders as each country scrambles to impose their laws on it. I'm glad to have known the true internet before its demise. Truly one of the wonders of humanity.
- binaryturtle 5mo ago
  I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."
  - tardedmeme 5mo ago
sandeepkd 5mo ago
> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecologically a nightmare), probably fingerprinting is the way to go - completely destroying the privacy of everyone involved. Bot protection with fingerprinting is just an illusion. Any signals like this which is on client side can be spoofed by an above average person. Fingerprinting is just way to consolidate the market for advertising business. Assigning Reputation to residential IP addresses and commercial blocks is is another approach to achieve the desired result. Providers would be a lot more careful to allow their IP addresses for misuses, however turns out that it would bring down the DDOS business on both sides, attackers and protectors. Ironically, more than often its the same companies that invest in building their own bots and finding ways to stop bots from other companies.
- esrauch 5mo ago
  > Bot protection with fingerprinting is just an illusion. Any signals like this which is on client side can be spoofed by an above average person. At the upper bound, fraud can always be committed by paying real people with real accounts to perform the desired action in a way that is 100% truly indistinguishable from organic. There's fundamentally actual prevention technique at the limit. So the entire game is only "increasing the costs until it's not viable ROI", not "holistically prevent", which is why fingerprinting is a relevant technique here.
  - sandeepkd 5mo ago
    > entire game is only "increasing the costs until it's not viable ROI", not "holistically prevent", which is why fingerprinting is a relevant technique here. As per cloudlare's own report, about 78% of the DDOS attacks are at the network layer where the fingerprinting technique is not useful. DDOS is done against targets for certain reasons, most businesses are not even viable targets for everyone. However letting everyone being fingerprinted on the pretext of solving the DDOS is where the privacy gets compromised (not much of it is left though). Some search engines did it indirectly by letting people use tag managers for free in their website and then utilize the data for their advertising business. Relatively the end game is same, its just how these companies are approaching it.
gadders 5mo ago
They're also anti free speech.
leonidasrup 5mo ago
Fingerprinting for "bot protection" is indistinguishable from fingerprinting for mass surveillance.
- mornanding 5mo ago
  Talking about mass surveillance: After taking the usual measurements against cross-site browser tracking- who knows most about my website visits? Meta, Google or Cloudflare? Blocking me from site visits with fingerprinting shut off, forces all my traffic back into the CF funnel. Number of websites soaring. Try it yourself https://sereneblue.github.io/chameleon https://sereneblue.github.io/chameleon https://github.com/kkapsner/CanvasBlocker/ https://github.com/kkapsner/CanvasBlocker/ and you're increasingly off.
- UqWBcuFx6NV4r 5mo ago
  [flagged]
  - 348752389 5mo ago
    [dead]
- account42 5mo ago
  And incentives mean those doing the former will also do the latter.
- brookst 5mo ago
  Sure, this is the age-old “knife used to cut steak is indistinguishable from knife used to stab people” thing. Tools are inherently amoral; only people can have motives we can celebrate or condemn.
  - leonidasrup 5mo ago
    Is the value provided by Cloudflare to public so great, that we are willing to pay for it by enabling mass surveillance?
jorvi 5mo ago
Brave has aggressive fingerprinting protection, I have Auto-Shred (formerly Forgetful Browsing) turned on, I use VPN and yet I rarely get gated out.
- high_priest 5mo ago
  A testament to how well Brave protects you from being identified by [Cloudflare in this example]
  - jorvi 5mo ago
    Not sure what you mean, Brave blows Firefox out of the water in terms of privacy protections. Firefox has milquetoast fingerprint protection and it doesn't even block ads. uBlock is worse than Brave's blocking by virtue of not being natively integrated.
fsckboy 5mo ago
>probably fingerprinting is the way to go - completely destroying the privacy of everyone involved your doctor seeing you naked does not destroy your privacy, it's your doctor sharing the photos with everybody that does. i.e. it problem here is that intermediaries like cloudflare don't work for you, they work for somebody else or sell the data themselves.
- TurdF3rguson 5mo ago
  Wait, is your doctor taking photos of you naked?
  - defrost 5mo ago
    Molescan doctors do - they map the skin, log it, and look for changes over time.
jchw 5mo ago
JA3 fingerprinting is really not a serious deterrent, there are many ways to get around that. curl-impersonate works. You can even just use an actual Chrome instance with the devtools protocol, seems to pass as long as you don't use headless mode. The WebGL fingerprinting thing is cute, too. I guess it'll buy them some time since off-the-shelf solutions are going to probably not handle this well yet. That said, as long as the reward for bypassing turnstile and other anti-bot protections remains high, these things really can't do much. A decently resourced adversary can probably come up with a dozen different approaches to make this less useful. Without really looking into it much, my kneejerk is you could probably tweak Mesa to have deterministically random behavior for whatever edge cases it looks for, but you could also just have lots of different GPU/driver combos to proxy to. The web gets less open, but in an asymmetrical way. If you really have an incentive to keep botting, you'll surely find a way. The next step is to fully give up and just essentially implement WEI. And then the bot problem disappears? Nope. Botting will still hold tremendous value, so likely there will be many crafty workarounds and bypasses over time. And there will be countermeasures for those and workarounds for that. Guess we'll start to find out who actually has the resources and incentives to keep botting in this environment. So what's the real solution? Well the most obvious thing to do would be to make botting less valuable. Can we? I dunno. It may have been a mistake to move so many important things to the Internet after all. I mean, some of this is just threat actors catching up with what's possible and was inevitable to begin with. But, some of it is just trying to find solutions to problems that were unnecessary to begin with. Or failing to implement solutions despite an obvious need to do so. There are a lot of threads to pull on, here. Account takeover still holds tremendous value to threat actors. Why? In my opinion, it's because passkeys were a tremendous failure, no matter what adoption shows. If we wanted to just improve security for users, I think we didn't need to restructure the internet around another authentication mechanism that of course, provides attestation capabilities, we could've just improved on passwords. For more secure handling of passwords, PAKEs exist. Password managers exist. For anti-phishing, TOTPs exist. What if you could have the exact same passkey experience, but in such a way that everything can gracefully fallback to just passwords and TOTP, because they're the real keymatter at the end of it? Add a web standard that lets browsers and browser extensions hook into the login process, standardize PAKEs as part of the web. Cross-vendor syncronization? A problem easily solved if we ever wanted to. Instead of that, we got the dumbest possible world. Passkeys are sometimes available, but often not. Can you sync your passkeys across devices? Probably, maybe they have blacklisted KeepassXC by now so maybe I can't :) But a lot of stuff doesn't even offer me the option to use passkeys, so they still use passwords. Can I enter my password to log in still? No, of course not. See, I will helpfully get the option to enter my password, in addition to the option to use email or SMS, the most secure authentication scheme known to Man, but if I actually select password and enter my secure password from my secure password manager, what I get to find out is that the password option is actually password and email or SMS and there's no option to use TOTP. Oh, and you randomly get logged out for no reason sometimes. Some of the bots will probably disappear. Like, whatever bot is throwing me several terabytes of nonsense traffic every month will probably eventually disappear since they're wasting so much bandwidth on doing literally nothing. I have no idea what the point is, but I know it can't be terribly valuable for them, and it's not terribly expensive for me. I'd love to know who the hell is doing that and why, though. But since the web is ran mostly by crap companies like Google, it will never get its shit together, and we will get solutions like WEI and identitity verification to solve problems that were entirely manufactured (or caused by a significant lack therefore of) in the first place.
bawolff 5mo ago
> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecologically a nightmare), probably fingerprinting is the way to go - completely destroying the privacy of everyone involved. I hate what the anti scrapper mechanisms have become but it really is the lesser evil. The alternative for many small operators is to just completely shutdown.
himata4113 5mo ago
I mean all bot protection is useless at the end of the day, every time I have to bypass it I can do so in roughly 3 to 5 hours both 2 years and and more recently around 1 month ago. 2 years ago it was an absolute joke and only took me 30 minutes. Well I mean maybe it wasn't useless 2 years ago, but in the age of AI it definitely is.
choppaface 5mo ago
besides proof-of-work, is there any realistic alternative to fingerprinting?
novok 5mo ago
Micropayments would be another one, but then governments and banks have to give up ~~financial control & surveillance~~ AML essentially to make it financially viable. AML also has a horrible track record of how much money is spent compared to the amount recovered.
- actionfromafar 5mo ago
  Wouldn't micropayments be aggregated into a money laundering operation by some third party? (Wasn't IIRC even Spotify used for that?) Or would Cloudflare take all the money in this hypothetical scenario?
- dcrazy 5mo ago
  Anti-money laundering laws are a deterrent. If you know moving around $10,000 will be reported to FinCEN, as will any discovered pattern of structuring transactions below $10,000, then you are forced to pursue riskier ways of moving your money than Western Union.
raxxorraxor 5mo ago
I would like my browser to not pass their challenge and then flush support of services I cannot reach. This is the only way for them to stop, to really get on the nerves of their customers. Those might ignore it, but there are always alternatives.
- UqWBcuFx6NV4r 5mo ago
  That is delusional. Nobody is getting on anyone’s nerves, materially. The people who care about this are a rounding error of a rounding error.
  - brookst 5mo ago
    It’s always amusing when someone brings up the “just tell banks that if they reduce account takeovers by 80%, it will drive off 3 customers a year (and those are the same 3 customers who call site support to complain the website doesn’t work well on their homebrew Chromium for when running on BSD” Cloudflare only exists in its current form because banks and such already enthusiastically accepted that trade off.
  - raxxorraxor 5mo ago
    I don't think it is delusional. Maybe ineffective. I think it is delusional to just accept these privacy invading measures as inevitable. Especially for software services today, there often is an alternative. Most businesses don't have the luxury to be able to not care for the customer. Cloudflare is a service provider for third parties, not the product I want to consume.
- dchest 5mo ago
  They'll just tell you to clear cookies and use Chrome.
account42 5mo ago
> but unless you do PoW (which is also ecologically a nightmare), probably fingerprinting is the way to go Only as long as legislation and law enforcement is off the table. Almost like we have those because everyone doing their own policing is not a reasonable way to run a society.
miki123211 5mo ago
PoW doesn't fix anything if you have an army of zombie CCTV cameras and smart fridges at your disposal. It's either proof-of-humanity (increasingly hard to get in this day and age, particularly if accessibility is a concern), proof odf identity (even worse) or proof of system integrity, which is the least bad out of all the terrible options.
- gspr 5mo ago
  Why wouldn't PoW help? If it's tuned so that each device in that army takes 10 seconds instead of 10 milliseconds to make a request, have you not slowed the army down by a factor 1000?
  - nine_k 5mo ago
    You just need 1000x more zombie fridges, which may be still acceptable for some bad actors.
    - denysvitali 5mo ago
      But more expensive (to get). At the same time, the PoW would require more compute power do the same device will still be capped at the same rps
    - gspr 5mo ago
      Sure. But this is kind of vacuously true for any real world DoS scenario. It's like saying "sure, your new weapons system might wipe out 999 out of every 1000 of the enemy's forces, but what does it matter, they can just scale up by a factor 1000 and we're back where we started". Anything that amplifies the cost and effort required by the adversary by several orders of magnitude is worthwhile discussing.
  - Catloafdev 5mo ago
    Then every normal user has to take 10 seconds as well, which is an awful experience.
    - 5mo ago
stellamariesays 5mo ago
[flagged]

PearlRiver 5mo ago

This is why I have two separate browsers. If you want to do official stuff like paying for things you need to get through cloudflare.

helterskelter 5mo ago
Firefox added profile switching recently. Works good. (That said, I still keep separate machines. One for doing "official" things, the other for everything else)
- b65e8bee43c2ed0 5mo ago
  >Works good. does it? same binary, same machine, same display, same 781 other heuristics.
- ajb 5mo ago
  Odd - they've had that for years, but only on the command line. Wonder if it's different under the hood? They also have firefox containers which also never quite became a first-class feature (you have to install a plugin).
  - deleted 5mo ago
    [deleted]
- notafox 5mo ago
  > Firefox added profile switching recently. I think this was as recent as 25 years ago? Recently they added some new UI. There was and still is (I think) classic Profile Manager UI, which you can launch with ./firefox -ProfileManager or access UI in about:profiles. But you don't have to use any of those anyway - see my comment above (a response to parent).
  - opem 5mo ago
    They actually have at least 3 kinds of profile: 1. containers - As they say its somekind of sandbox, technically a profile 2. profiles that are accesible through about:proflies, which they had for years, and probably the one you are talking about... 3. New profiles that comes with a pop-up much like how chromium browsers shows it
  - thayne 5mo ago
    The old UI was pretty difficult to use, and hard to discover unless you knew where to look though.
    - zelphirkalt 5mo ago
      What about the old UI is difficult to use? I am assuming you are talking about the profile manager.
notafox 5mo ago
You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles. Firefox with a non-default profile can be created like that: ./firefox -CreateProfile "profile-name /home/user/.mozilla/firefox/profile-dir/" # For, say, cloudflare that would be: ./firefox -CreateProfile "cloudflare /home/user/.mozilla/firefox/cloudflare/" And you can launch it like that: ./firefox -profile "/home/user/.mozilla/firefox/profile-dir/" # For cloudflare that would be: ./firefox -profile "/home/user/.mozilla/firefox/cloudflare/" So, given that /usr/bin/firefox is just a shell script, you can - create a copy of it, say, /usr/bin/firefox-cloudflare - adjust the relevant line, adding the -profile argument If you use an icon to run firefox (say, /usr/share/applications/firefox.desktop), you'll need to do copy/adjust line for the icon. Of course, "./firefox" from examples above should be replaced with the actual path to executable. For default installation of Firefox the path would be in /usr/bin/firefox script. So, you can have a separate profiles for something sensitive/invasive (linkedin, cloudflare, shops, banks, etc.) and then you can have a separate profile for everything else. And each profile can have its own set of extensions.
- ferfumarma 5mo ago
  Except that fingerprinting means that both profiles are actually tied together by cloudflare (and other tech companies)
  - VoidWhisperer 5mo ago
    I think the idea is that they have the functionality that cloudflare is using to generate the fingerprint (like webGL in this case) disabled in their non-cloudflare profile and only use the cloudflare profile to do things they have to that are behind cloudflare
  - ranger_danger 5mo ago
    that's why I use completely different browsers with different settings. my CF-friendly one (not my daily driver) is `firejail --private chromium` so it always starts with a clean temporary profile
- 5mo ago

b65e8bee43c2ed0 5mo ago

it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.

ACCount37 5mo ago
At the same time: it sure works well enough to annoy anyone with a "bad ASN" IP with 80 captchas a day.
- shideneyu 5mo ago
  exactly that's what I was thinking... like the day they provided a solution to the issue they posed
- marysol5 5mo ago
  It's how I remember I've left my VPN on
mootothemax 5mo ago
Exactly. I’m constantly amazed at how little you actually need to bypass CF, Amazon, Azure WAFs and so on (Incapsula springs to mind too). When you look at the code you’ve come up with, it’s actually quite small and compact. More to the point, these systems actually help scraping because proof of work unlocks essentially unlimited scraping, in my experience. That said - from my experience on the other side, sure you can’t stop people like me or you, but you can stop 99% of the others. That’s more than worth it operationally.
- Chris2048 5mo ago
  What do you mean by ~"PoW unlocks unlimited scraping"?
  - danielheath 5mo ago

petu 5mo ago

> but unless you do PoW (which is also ecologically a nightmare) Can you expand? I don't see a problem with some napkin math. 5W load for 2 seconds is 0.002Wh (we have to let smartphones pass and not by doing PoW for 10s of seconds). 8 billion checks a day for a year = 8GWh.

denysvitali 5mo ago
I stand corrected. It's not a nightmare scenario (as for Bitcoins) - but I'm still of the idea that "useless" computations should be avoided (as we should avoid having 10MB websites). In any case, according to some napkin math done by Kimi 2.6 (which by itself is probably already consuming more than all of my PoW challenges for the upcoming 5 years) - the situation looks incredibly in favor of PoW: https://www.kimi.com/share/19e7ef40-a432-8912-8000-0000b4a714cf https://www.kimi.com/share/19e7ef40-a432-8912-8000-0000b4a71... Which makes me wonder why CloudFlare isn't switching to this already
- dcrazy 5mo ago
  Because it doesn’t solve the problem of residential botnets.
  - dotancohen 5mo ago
    Neither does fingerprinting.
    - dcrazy 5mo ago
      The goal of Cloudflare’s fingerprinting is to detect whether a user agent appears to be a legitimate human. It’s not to identify human users across websites.
      - zzo38computer 5mo ago
        That is not a good excuse for requiring overly complicated and overly specific software.

jwr 5mo ago

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection" They also gate away a good many people with their "bot protection". I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever.

denysvitali 5mo ago
They sometimes have to comply with legal requests (which I understand), but at the same time they have a huge market share - which means that the internet is becoming less and less decentralized and more in their control. We've seen the effects of that in previous outages...
stackghost 5mo ago
>I am extremely worried about how so many seem to have outsourced the control over who can access their websites to a company, with no second thoughts whatsoever. I think the Web is on its last legs, anyway. Generative AI and LLM-instead-of-search has destroyed what little value remained.
- matheusmoreira 5mo ago
  Governments too. It's inevitable that the international network will fracture into multiple national networks with heavy filtering at the borders as each country scrambles to impose their laws on it. I'm glad to have known the true internet before its demise. Truly one of the wonders of humanity.
binaryturtle 5mo ago
I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."
- tardedmeme 5mo ago

sandeepkd 5mo ago

> I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecologically a nightmare), probably fingerprinting is the way to go - completely destroying the privacy of everyone involved. Bot protection with fingerprinting is just an illusion. Any signals like this which is on client side can be spoofed by an above average person. Fingerprinting is just way to consolidate the market for advertising business. Assigning Reputation to residential IP addresses and commercial blocks is is another approach to achieve the desired result. Providers would be a lot more careful to allow their IP addresses for misuses, however turns out that it would bring down the DDOS business on both sides, attackers and protectors. Ironically, more than often its the same companies that invest in building their own bots and finding ways to stop bots from other companies.

esrauch 5mo ago
> Bot protection with fingerprinting is just an illusion. Any signals like this which is on client side can be spoofed by an above average person. At the upper bound, fraud can always be committed by paying real people with real accounts to perform the desired action in a way that is 100% truly indistinguishable from organic. There's fundamentally actual prevention technique at the limit. So the entire game is only "increasing the costs until it's not viable ROI", not "holistically prevent", which is why fingerprinting is a relevant technique here.
- sandeepkd 5mo ago
  > entire game is only "increasing the costs until it's not viable ROI", not "holistically prevent", which is why fingerprinting is a relevant technique here. As per cloudlare's own report, about 78% of the DDOS attacks are at the network layer where the fingerprinting technique is not useful. DDOS is done against targets for certain reasons, most businesses are not even viable targets for everyone. However letting everyone being fingerprinted on the pretext of solving the DDOS is where the privacy gets compromised (not much of it is left though). Some search engines did it indirectly by letting people use tag managers for free in their website and then utilize the data for their advertising business. Relatively the end game is same, its just how these companies are approaching it.

gadders 5mo ago

They're also anti free speech.

leonidasrup 5mo ago

Fingerprinting for "bot protection" is indistinguishable from fingerprinting for mass surveillance.

mornanding 5mo ago
Talking about mass surveillance: After taking the usual measurements against cross-site browser tracking- who knows most about my website visits? Meta, Google or Cloudflare? Blocking me from site visits with fingerprinting shut off, forces all my traffic back into the CF funnel. Number of websites soaring. Try it yourself https://sereneblue.github.io/chameleon https://sereneblue.github.io/chameleon https://github.com/kkapsner/CanvasBlocker/ https://github.com/kkapsner/CanvasBlocker/ and you're increasingly off.
UqWBcuFx6NV4r 5mo ago
[flagged]
- 348752389 5mo ago
  [dead]
account42 5mo ago
And incentives mean those doing the former will also do the latter.
brookst 5mo ago
Sure, this is the age-old “knife used to cut steak is indistinguishable from knife used to stab people” thing. Tools are inherently amoral; only people can have motives we can celebrate or condemn.
- leonidasrup 5mo ago
  Is the value provided by Cloudflare to public so great, that we are willing to pay for it by enabling mass surveillance?

jorvi 5mo ago

Brave has aggressive fingerprinting protection, I have Auto-Shred (formerly Forgetful Browsing) turned on, I use VPN and yet I rarely get gated out.

high_priest 5mo ago
A testament to how well Brave protects you from being identified by [Cloudflare in this example]
- jorvi 5mo ago
  Not sure what you mean, Brave blows Firefox out of the water in terms of privacy protections. Firefox has milquetoast fingerprint protection and it doesn't even block ads. uBlock is worse than Brave's blocking by virtue of not being natively integrated.

fsckboy 5mo ago

>probably fingerprinting is the way to go - completely destroying the privacy of everyone involved your doctor seeing you naked does not destroy your privacy, it's your doctor sharing the photos with everybody that does. i.e. it problem here is that intermediaries like cloudflare don't work for you, they work for somebody else or sell the data themselves.

TurdF3rguson 5mo ago
Wait, is your doctor taking photos of you naked?
- defrost 5mo ago
  Molescan doctors do - they map the skin, log it, and look for changes over time.

jchw 5mo ago

JA3 fingerprinting is really not a serious deterrent, there are many ways to get around that. curl-impersonate works. You can even just use an actual Chrome instance with the devtools protocol, seems to pass as long as you don't use headless mode. The WebGL fingerprinting thing is cute, too. I guess it'll buy them some time since off-the-shelf solutions are going to probably not handle this well yet. That said, as long as the reward for bypassing turnstile and other anti-bot protections remains high, these things really can't do much. A decently resourced adversary can probably come up with a dozen different approaches to make this less useful. Without really looking into it much, my kneejerk is you could probably tweak Mesa to have deterministically random behavior for whatever edge cases it looks for, but you could also just have lots of different GPU/driver combos to proxy to. The web gets less open, but in an asymmetrical way. If you really have an incentive to keep botting, you'll surely find a way. The next step is to fully give up and just essentially implement WEI. And then the bot problem disappears? Nope. Botting will still hold tremendous value, so likely there will be many crafty workarounds and bypasses over time. And there will be countermeasures for those and workarounds for that. Guess we'll start to find out who actually has the resources and incentives to keep botting in this environment. So what's the real solution? Well the most obvious thing to do would be to make botting less valuable. Can we? I dunno. It may have been a mistake to move so many important things to the Internet after all. I mean, some of this is just threat actors catching up with what's possible and was inevitable to begin with. But, some of it is just trying to find solutions to problems that were unnecessary to begin with. Or failing to implement solutions despite an obvious need to do so. There are a lot of threads to pull on, here. Account takeover still holds tremendous value to threat actors. Why? In my opinion, it's because passkeys were a tremendous failure, no matter what adoption shows. If we wanted to just improve security for users, I think we didn't need to restructure the internet around another authentication mechanism that of course, provides attestation capabilities, we could've just improved on passwords. For more secure handling of passwords, PAKEs exist. Password managers exist. For anti-phishing, TOTPs exist. What if you could have the exact same passkey experience, but in such a way that everything can gracefully fallback to just passwords and TOTP, because they're the real keymatter at the end of it? Add a web standard that lets browsers and browser extensions hook into the login process, standardize PAKEs as part of the web. Cross-vendor syncronization? A problem easily solved if we ever wanted to. Instead of that, we got the dumbest possible world. Passkeys are sometimes available, but often not. Can you sync your passkeys across devices? Probably, maybe they have blacklisted KeepassXC by now so maybe I can't :) But a lot of stuff doesn't even offer me the option to use passkeys, so they still use passwords. Can I enter my password to log in still? No, of course not. See, I will helpfully get the option to enter my password, in addition to the option to use email or SMS, the most secure authentication scheme known to Man, but if I actually select password and enter my secure password from my secure password manager, what I get to find out is that the password option is actually password and email or SMS and there's no option to use TOTP. Oh, and you randomly get logged out for no reason sometimes. Some of the bots will probably disappear. Like, whatever bot is throwing me several terabytes of nonsense traffic every month will probably eventually disappear since they're wasting so much bandwidth on doing literally nothing. I have no idea what the point is, but I know it can't be terribly valuable for them, and it's not terribly expensive for me. I'd love to know who the hell is doing that and why, though. But since the web is ran mostly by crap companies like Google, it will never get its shit together, and we will get solutions like WEI and identitity verification to solve problems that were entirely manufactured (or caused by a significant lack therefore of) in the first place.

bawolff 5mo ago

himata4113 5mo ago

I mean all bot protection is useless at the end of the day, every time I have to bypass it I can do so in roughly 3 to 5 hours both 2 years and and more recently around 1 month ago. 2 years ago it was an absolute joke and only took me 30 minutes. Well I mean maybe it wasn't useless 2 years ago, but in the age of AI it definitely is.

choppaface 5mo ago

besides proof-of-work, is there any realistic alternative to fingerprinting?

novok 5mo ago

Micropayments would be another one, but then governments and banks have to give up ~~financial control & surveillance~~ AML essentially to make it financially viable. AML also has a horrible track record of how much money is spent compared to the amount recovered.

actionfromafar 5mo ago
Wouldn't micropayments be aggregated into a money laundering operation by some third party? (Wasn't IIRC even Spotify used for that?) Or would Cloudflare take all the money in this hypothetical scenario?
dcrazy 5mo ago
Anti-money laundering laws are a deterrent. If you know moving around $10,000 will be reported to FinCEN, as will any discovered pattern of structuring transactions below $10,000, then you are forced to pursue riskier ways of moving your money than Western Union.

raxxorraxor 5mo ago

I would like my browser to not pass their challenge and then flush support of services I cannot reach. This is the only way for them to stop, to really get on the nerves of their customers. Those might ignore it, but there are always alternatives.

UqWBcuFx6NV4r 5mo ago
That is delusional. Nobody is getting on anyone’s nerves, materially. The people who care about this are a rounding error of a rounding error.
- brookst 5mo ago
  It’s always amusing when someone brings up the “just tell banks that if they reduce account takeovers by 80%, it will drive off 3 customers a year (and those are the same 3 customers who call site support to complain the website doesn’t work well on their homebrew Chromium for when running on BSD” Cloudflare only exists in its current form because banks and such already enthusiastically accepted that trade off.
- raxxorraxor 5mo ago
  I don't think it is delusional. Maybe ineffective. I think it is delusional to just accept these privacy invading measures as inevitable. Especially for software services today, there often is an alternative. Most businesses don't have the luxury to be able to not care for the customer. Cloudflare is a service provider for third parties, not the product I want to consume.
dchest 5mo ago
They'll just tell you to clear cookies and use Chrome.

account42 5mo ago

> but unless you do PoW (which is also ecologically a nightmare), probably fingerprinting is the way to go Only as long as legislation and law enforcement is off the table. Almost like we have those because everyone doing their own policing is not a reasonable way to run a society.

miki123211 5mo ago

PoW doesn't fix anything if you have an army of zombie CCTV cameras and smart fridges at your disposal. It's either proof-of-humanity (increasingly hard to get in this day and age, particularly if accessibility is a concern), proof odf identity (even worse) or proof of system integrity, which is the least bad out of all the terrible options.

gspr 5mo ago
Why wouldn't PoW help? If it's tuned so that each device in that army takes 10 seconds instead of 10 milliseconds to make a request, have you not slowed the army down by a factor 1000?
- nine_k 5mo ago
  You just need 1000x more zombie fridges, which may be still acceptable for some bad actors.
  - denysvitali 5mo ago
    But more expensive (to get). At the same time, the PoW would require more compute power do the same device will still be capped at the same rps
  - gspr 5mo ago
    Sure. But this is kind of vacuously true for any real world DoS scenario. It's like saying "sure, your new weapons system might wipe out 999 out of every 1000 of the enemy's forces, but what does it matter, they can just scale up by a factor 1000 and we're back where we started". Anything that amplifies the cost and effort required by the adversary by several orders of magnitude is worthwhile discussing.
- Catloafdev 5mo ago
  Then every normal user has to take 10 seconds as well, which is an awful experience.
  - 5mo ago

stellamariesays 5mo ago

[flagged]