Comment by halifaxbeard | Hacker News Reader

Top New Best Ask Show Jobs

Comment by halifaxbeard | Hacker News Reader

Parent Full thread

Setup Cloudflare on the domain and turn on “bot fight mode”.

If the TLS ciphers the client proposes for negotiation doesn’t align with the client’s User-Agent they get a CAPTCHA.

I would suspect that whoever is doing this proxy-mirroring isn’t smart enough to ensure the TLS ciphers align with the User-Agent they’re passing through.

I would agree with the above, as an easier version of TLS fingerprinting. One could also ise nginx/haproxy to extract enough TLS info, and detect requests xoming through proxy Magic string: JA3 fingerprint

This is the correct first step.

On the free tier, does bot fight mode do anything other than simply detect bots based on JavaScript detections?

Reply on news.ycombinator.com