Hacker News Reader

Comment by tren | Hacker News Reader

If Cloudflare is your main problem, you could use privacy pass - https://developers.cloudflare.com/support/firewall/settings/...

View on HN

Seems like old "make a problem, sell a solution"...

The people using VPNs and clearing cookies are the ones making the problem. Cloudflare is offering a solution for those people.

I disagree entirely. Calling innocent people "the problem" seems wrong-headed to me. Spammers and scammers are the problem. Captchas are one way of handling that problem, but introduce problems of their own.

People using the internet in legitimate ways are not the problem.

> "This add-on needs to: Access your data for all websites"

Ouch!

There is no less sensitive permission that would let you implement an extension like this. "Access your data" means "run JavaScript in page context" and you need to do this in order to get the browser to send the CAPTCHA token to the server. The only technical restrictions you can apply to this are domain-based, but you can stick CloudFlare on any domain.

Plenty of other useful extensions need this permission too.

I'm not sure how addons can bypass V2 reCAPTCHAs as they operate from iframes and JavaScript can't acces cross-domain content to, ie, click buttons, access urls, or interact with forms. Nonetheless it seems to work, so maybe addon JavaScript is more privileged than developer-console JavaScript.

I've seen some v3 reCAPTCHA solvers, such as pyPasser, but I don't understand how they work. They seem to use a hard-coded constant to perform a replay attack to get a token which is guaranteed to succeed ie generate a high score. But... that can't be possible, can it?

Although I know that many administrators turn off Privacy Pass support. Still worth trying out for those that don't.

Reply on news.ycombinator.com