Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

Re:Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a... by midev on Friday May 14, 2021 @10:55AM (#27154951)

Customers pay for this as a feature. Why would they feel it's a fundamental problem? There's nothing that says admins need to let you crawl their site.

[ Parent | on HN ]

Re:Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a... by vidarh on Friday May 14, 2021 @11:03AM (#27155033)

If people intend this to happen, sure . But how many people who put their sites behind Cloudflare is aware that this might be a side effect?

[ Parent | on HN ]

Re:Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a... by midev on Friday May 14, 2021 @11:08AM (#27155083)

I would wager that most people that purchase Cloudflare are probably aware of the features it offers

[ Parent | on HN ]

Re:Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a... by vidarh on Friday May 14, 2021 @01:51PM (#27157394)

Note the distinction. I'd wager that the vast majority of sites behind Cloudflare are not paying customers, and have not paid much attention beyond "hides my server IP slightly and stops DDOS's", without having thought more - or at all - about the wider implications.

[ Parent | on HN ]

Re:Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a... by joepie91_ on Sunday May 16, 2021 @07:28AM (#27172920)

This is exactly the case.

[ Parent | on HN ]