> How would a virus scan help here?

Usually that means that the IP you are connecting from got somehow flagged as an originator of malicious attacks. Like if the virus on your computer does automated requests (click fraud, scraping, DoS,...) to other IPs that are monitored by them.

Of course this is probably mostly useless especially if you are on a dynamic IP but that's where it's coming from.

this line of text was more appropriate when this text only showed up when CF had a low "trust score" for you; now website owners have much more control and can trigger a captcha for almost any reason that doesn't necessarily mean your network is infected (eg. A website owner triggering captchas on a page of their website once they have a heavy increase of traffic)

I was only answering to the part about why they suggest virus scan, not the usage of captchas in general. Of course you are right in regards to captchas in general.

I'm getting the same issue. I also use CDN from cloudflare for my personal sites...and this is making me reconsider using it.

Giving cloudflare the benefit of the doubt, what could trip this is:

1) the site is getting higher than average visits (tripping the anti-DDoS flag for the CDN)

2) I went without javascript on, so they think I am just a bot.

EDIT: after giving it the benefit of the doubt, the captha didn't work for me at least 4 times. That is unacceptable.

I got the same CAPTCHA, running Firefox 68.4.1 on Linux. Normally when this kind of thing happens, I just close the tab and move on with my life. But this time I tried opening with Chromium instead (version 76.0.3809.100) and then no CAPTCHA was required. Neither browser has Privacy Pass, so why are they treated differently?

So you have script blocker on both and configured same way? I get captcha requests on my firefox with umatrix due to aggressive blocking.

No blockers, just using the built-in privacy/incognito modes.

I think that the site backend is having trouble keeping up with the load and the owner turned on Cloudflare’s Under Attack mode, thinking that this was a DDoS. This doesn’t look like the behavior I’ve seen when Cloudflare does it automatically. It’s smart enough to know that HN is not a DDoS.

A common question on the CF forum is a requests/second trigger for either enabling Under Attack mode or enabling a Firewall rule that triggers the full hCaptcha page. This is most likely what happened here.

[This is usually done by counting requests/second at the origin then using the CF API to enable the firewall rule or change the security level)

I have an add-on that removes referrer strings...but when I disabled that I get the same issue.

When I checked it on my phone (Android, mobile Firefox with the same add-ons), I was able to go fine.

This depends a lot on the "Security Level" (Firewall > Settings) we pick on Cloudflare's settings for our site.

On my sites I set it to "essentially off", only ips with really bad reputation see the captcha.

Thanks for the note on that. I'm still new to using cloud flare.

    > And how does Privacy Pass prove I'm human, are robots unable to pretend to be Firefox plus Privacy Pass?

Privacy pass just like some blockchain tech require to spend some computational resources in order to get tokens. After all CloudFlare goal isn't to block bots as is, but to make DDoS attacks and mass vulneribility scan more expensive.

That’s not what privacy pass is. There’s no proof of work involved. Basically you solve a captcha once, and it gives you 30 tokens to skip future captchas.

> In preliminary tests on consumer hardware, our extension takes ~1.1 seconds to generate blinded tokens to be signed by the server and ~1.9 seconds to parse the signed tokens and verify the DLEQ proof. Creating a pass that can be used to redeem signed tokens takes <40ms.

It's intentionally very slow to get and use those token though

That seems to be a side effect of the zero knowledge proof implementation, rather than an explicit design choice. There doesn’t seem to be a tunable “difficultly” parameter, like with all proof of work implementations.

If we assume a spherical cow and say that there are no rate limits on the captcha service and capture solves are instant, then privacy pass requires you to spend 100ms of CPU time before each request, which is a sort of "work"

If we then say that the captcha you solve can be dynamically adjusted based on how suspicious the request is, then that is a sort of difficulty tuning.

Sure this isn't exactly blockchains or whatever, but it's basically the same idea.

Why would CloudFlare endorse this system if it was just "business as normal but you solve 1/30th of the captchas"?

> Why would CloudFlare endorse this system if it was just "business as normal but you solve 1/30th of the captchas"?

They don't just endorse it, they developed it. Their argument was that it allowed them to solve the "Tor CAPTCHA problem" (as a Tor user, you see CAPTCHA on almost every page visit to a CloudFlare-fronted site) without breaking the anonymity of Tor users (because CloudFlare is in a position to maliciously track a scary amount of Tor exit traffic).

The idea is that this 1/30 multiplier is meant to reduce the amount of pain Tor users have, without making attackers' jobs easier (a factor of 30 isn't really that much of a change for most attackers and CloudFlare has DDoS protection beyond just CAPTCHA, but it does make a huge difference for normal users).

All of that being said, the Tor project does not endorse the usage of PrivacyPass because they are ethically opposed to the entire concept of having to get a hall pass from CloudFlare to browse large swathes of the internet. And being one of a handful of PrivacyPass users on Tor will reduce your anonymity significantly. The Tor Projecy might also disagree with the privacy claims made by PrivacyPass, but given they are against the very idea of the project I believe they haven't done any actual research into their claims.

> Sure this isn't exactly blockchains or whatever, but it's basically the same idea.

This idea is older than blockchains; it's basically hashcash (https://en.wikipedia.org/wiki/Hashcash), which AFAIK was one of the inspirations for Bitcoin.

Yeah I should have used some better example, but from my point of view Hashcash isn't very different from what I meant.