Hacker News Reader

Comment by cookiengineer | Hacker News Reader

With a normal Firefox on desktop on Linux, I get unsolvable recaptchas all the time, especially on cloudflare pages.

Ironically, if I fake instead a chromium to be on Windows (UA and Sec-CH headers), I am allowed most of the time even though my TCP fingerprint must mismatch then.

It's annoying to see what the normal web has become. Can't even read news anymore.

Ironically, all these bot defenses make it easier for bots to scrape their website, but make it harder for actual users to use them.

The only bot defense web app firewall that still works with Firefox seems to be Anubis. Pretty much all others autoflag Linux users as bot users, which feels insane if you think about less web developers must know about how botnets work.

View on HN

> With a normal Firefox on desktop on Linux, I get unsolvable recaptchas all the time, especially on cloudflare pages.

I get this with Chrome on MacOS.

I'm becoming more convinced that Cloudflare is the bane of the internet.

> I get unsolvable recaptchas all the time, especially on cloudflare pages.

If you really mean reCAPTCHA (the one with a “select all squares that have X” kinda challenges), then Cloudflare hasn’t used that for quite a while now. archive.today uses a Cloudflare-looking (old style) page with a reCAPTCHA (and they do serve it quite often), but I don’t think I’ve seen other sites do that.

No you can get literally unsolveable captchas with cloudflare. You tick the box and it just refreshes and displays the unticked box again. Or people it on gateway endpoints that just return plain text errors (Humble does this).

There's code that makes it do something different after 100+ failed retries but you can speed it up by editing the _cf_chl_rc_* cookie (which is just a number). I haven't yet worked out what it does differently.

With Firefox on my windows computer I never get unsolvable recaptchas or have any issues with Cloudflare.

> I get unsolvable recaptchas all the time, especially on cloudflare pages

Repeated problems with cf and similar like this seem to be more common for users behind CGNAT (most mobile users for example). Presumably all the other hosts sharing the same final outgoing address(es), some of which will be running bots either deliberately or because they've been infiltrated by malware, confuse the heuristics that decide how often checks should be made.

Reply on news.ycombinator.com