Hacker News Reader

Comment by shadowgovt | Hacker News Reader

Cloudflare uses a heuristic trust model where it pulls multiple trust signals from the client. It can use several things (including stable IP address, cookies, and I think even a bit of JavaScript grabbing a nonce from local storage).

If you run with a lot of "identity fuzzers" (browsing through Tor, JavaScript off, cookies banned), Cloudflare can't build its trust heuristics and needs to challenge-response more often. I suspect there's overlap between HN readers and use of those sorts of tools, so I think there is a disproportionate number of people around here who run into this issue (whereas most "regular" folk almost never see a Cloudflare challenge / response).

View on HN

I always encounter a "random" stop-and-solve-me-a-visual-puzzle when visiting an Australian forum related to SOHO networking equipment. According to the description on the challenge page, "completing the CAPTCHA proves you are a human and gives you temporary access to the web property". Thank you, Cf, I guess?

(To be fair, consecutive requests don't get this treatment, just the one in which I jump there from eg. a search result.)

They are breaking the web, plain and simple. Google with AMP, Cloudfare with their idiotic capchas.

No server is obligated to vend my client data.

More importantly: no server is obligated to vend data until it falls over and dies, depriving all users access to that data if it isn't mirrored.

I think Cloudflare has honestly done an admirable job of coming up with a novel solution to the problem of loadbalancing and traffic-shedding in a world with a small-but-persistent percentage of hostile actors.

One might argue that it's the abusive actors Cloudflare blocks who are breaking the web.

What's the alternative? Abusive traffic is the norm rather then an exception. This gets into the same argument when people say they don't need a CDN; it's a relic from when bad actors were rare.

If all I'm doing is requesting an HTML page, why do they have to send me a CAPTCHA? I understand that my request is coming from an IP belonging to a VPN and maybe someone used the same IP nefariously, but I doubt they requested the same page I have.

You can knock over a server with malicious requests of static content. In fact, what you are describing (requesting different pages) is the first step to trying to defeat a firewall rule that would protect against that attack.

This is the era after the invention of Low Orbit Ion Cannon. Attacks that would previously have been technically sophisticated can now be done with a few GitHub downloads and either many volunteers or many compromised machines.

Speaking of which, is it possible Cloudflare is paid by Google to display re-captchas? Someone needs to train those deep neurons.

Doesn’t Cloudflare use Hcaptcha now? They dropped Google because of the cost.

We don't use ReCAPTCHA: https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch...

> Cloudflare uses a heuristic trust model where it pulls multiple trust signals from the client.

The wording "heuristic trust model [...] trust signals from the client", would not be out of place in the context of a sigint discussion.

Just plain Chrome Mobile, nothing else, no VPN.

Interesting. The only other thing that immediately comes to mind is that the web site owner may have blocked the entire country (https://support.cloudflare.com/hc/en-us/articles/200170136-U...). This would be easiest to verify by seeing if other people with similar phone configuration standing next to you get the same experience.

Reply on news.ycombinator.com