Hacker News Reader

Comment by randunel | Hacker News Reader

How HIBP works for users navigating from third world countries:

It's a long .gif file which shows that cloudflare's website loads just fine, but HIBP is unusable. Thanks Troy and Cloudflare for making this (free) service unusable. It's free, so I shouldn't expect that it works, anyway. Chrome on Linux and no VPN, fwiw.

View on HN

The "Checking if site connect is secure" message pisses me off so much. They are lying straight to my face. It is about checking if they want to serve me, nothing about the site or my connection.

This annoys me to no end as well. Whenever I see that message, I just close the window and do something else.

>> https://imgur.com/a/K5z1X2R

> This post may contain erotic or adult imagery.

Yeah it’s fucked alright.

The "Mature (?)" checkbox is unticked, and there doesn't seem to be a different setting for it.

I believe the implementation is buggy, because I almost never see a Cloudflare page and I can consistently see one here when double-clicking the button.

This looks like an obvious misconfiguration, after passing the first quick Cloudflare check you should've been forwarded to a page with the right results. Sounds like Troy needs to fix his API calls.

Just out of interest, have you checked if installing Cloudflare's Privacy Pass bypasses the issue?

I’ve encountered this kind of loop on a number of different sites lately, so it may be more than a single misconfiguration. (US residential IP, using Firefox on Linux / Safari on iOS with Private Access Tokens disabled on principle).

I’ve just figured it was a fully intentional tarpit, and that I scored too high on some bot heuristic.

It's possible that the loop is just a tarpit, but based on the contents of the blog post I don't think this is intentional on the website's end.

I can think of different ways how this could go wrong (i.e. Cloudflare tries to forward the POST request and CSRF/WAF firewalls block the unexpected Cloudflare origin).

That looks like a misconfiguration by HIBP

That's pretty much what I expected would happen, none of those solutions ever worked.

Reply on news.ycombinator.com