Hacker News Reader

Comment by lxgr | Hacker News Reader

I don't think there's a way to avoid this game at this point, so I'd rather fast forward and see what lies at the end, given how painful the way there already is.

I'll take the constant, predictable pain of some equilibrium over constantly shifting pain any day. For example, I know which websites just don't support Firefox for web standards compatibility reasons and can use alternatives, but I don't know when Cloudflare will next decide to lock me out of half of the web for my crimes of using a free browser.

View on HN

Fast forward to the end? Okay - only validated devices running an attested secure boot chain with first-party Safari, Chrome, or MS Edge are allowed to connect to the web. Live ID verification is required for all account creation. Attested PassKeys are the only accepted login tool, and they must be bound to your device and stored in its TPM.

This very might be the only real solution to the cat and mouse game.

That's not the end because you can solder wires to an attested device to make it do unattested things.

The analog hole remains a problem (or opportunity, depending on your mindset). Even if you don't solder wires to the device, you can mount it in a plotter frame that pokes the screen and uses vision models to understand the screen. That won't be closed until they figure out how to mount the attested devices in your brain (see NeuraLink).

The actual end has all cryptographic keys used for remote attestation released to the public

Open source software will not embed them, but maybe ask you to download yourself

Perhaps - I know some of the Widevine keys are out in the wild, but I'm not sure that all of the L1 keys have been leaked. It seems like at least in theory, they could bake unique keys into the hardware and revoke them once they leak.

it's not cloudflare deciding, it's the website owners/operators. As someone who has made that decision: the trade is clear. Turnstile can reduce scaling requirements by more than half, greatly reducing our costs. Automated traffic can be very spiky: scrapers, scalpers, 0-day pen testers. We probably block 10,000 automated requests for every affected Firefox user... because it's not all Firefox users.

It's not that website operators are trying to punish you, it's that we can't survive without discriminating against automations, and your signal is getting mistaken.

Of course, I never assumed that it was an objective. It is however tolerated as an outcome, so it doesn’t really make a difference to me.

When did Cloudflare ever do this?

It's reasonably common if you take any kind of privacy preserving actions or really anything that makes you less identifiable.

I'd say cloudflare is less bad about it than some, but I worry my privacy preserving measures might simply be defeated at this point.

How does that relate to "Cloudflare will next decide to lock me out of half of the web for my crimes of using a free browser", though? Seems to be unrelated?

"using a free browser" = "take any kind of privacy preserving actions"

If you use an odd/fringe browser you are more likely to be caught by CF Turnstile and be locked out from websites.

Perhaps, but not as a punishment for using a free browser.

Whether it's on purpose or incidental doesn't matter.

Punishment is something done on purpose.

No, that's nowhere in the definition of punishment. A system can be constructed with strongly normative attributes that punish anyone trying to not conform with the norm, without any intentionality behind it.

You've just defined punishment with your definition of it.

Not always, see e.g. "punishing heat", i.e. sense 2 here: https://www.merriam-webster.com/dictionary/punishing

I was using that sense, and being hyperbolic with "crime". Cloudflare can cause bad outcomes for browser heterogeneity without any malicious intent whatsoever.

If I get locked out or get served captcha after captcha on Firefox (with or without my ad blocker and extended tracking prevention disabled) but everything works flawlessly on Chrome there's really only one conclusion I can draw.

Well, no, there are multiple. Thinking it's punishment for using a free browser is unsupported by your description.

I only use Firefox with tracking protection on and the DDG extension on, and it always works for me.

Just using Firefox is enough these days. I can't even book a train ticket on Firefox anymore. "Your behavior is similar to a bot. Try to log in to your account or use a different browser." My >10y tenured account with dozens of prior undisputed orders apparently does not matter as much as my user agent.

Reply on news.ycombinator.com