News for hackers. Stuff that matters.

A comment on Cloudflare Turnstile requiring fingerprintable WebGL. Parent comment

Re:Cloudflare Turnstile requiring fingerprintable WebGL by b65e8bee43c2ed0 on Sunday May 31, 2026 @11:47AM (#48346670)
it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by ACCount37 on Sunday May 31, 2026 @11:49AM (#48346686)
At the same time: it sure works well enough to annoy anyone with a "bad ASN" IP with 80 captchas a day.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by shideneyu on Sunday May 31, 2026 @12:18PM (#48346939)
exactly that's what I was thinking... like the day they provided a solution to the issue they posed
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by marysol5 on Tuesday June 02, 2026 @06:57AM (#48368549)
It's how I remember I've left my VPN on
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by mootothemax on Sunday May 31, 2026 @01:28PM (#48347606)
Exactly. I’m constantly amazed at how little you actually need to bypass CF, Amazon, Azure WAFs and so on (Incapsula springs to mind too). When you look at the code you’ve come up with, it’s actually quite small and compact.

More to the point, these systems actually help scraping because proof of work unlocks essentially unlimited scraping, in my experience.

That said - from my experience on the other side, sure you can’t stop people like me or you, but you can stop 99% of the others. That’s more than worth it operationally.

[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by Chris2048 on Monday June 01, 2026 @05:00AM (#48354288)
What do you mean by ~"PoW unlocks unlimited scraping"?
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by danielheath on Wednesday June 03, 2026 @07:45AM (#48382728)
Usually after you solve the POW challenge, sites let you make a lot of requests before asking you to complete another.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by ranger_danger on Sunday May 31, 2026 @07:25PM (#48350831)
> Cloudflare's scraping protection works about as well as a $5 padlock

It sure seems to keep me, the casual visitor, far away from just about any site they "protect". I have zero desire to alter my browsing configuration or use extra tools to get around turnstile, I'd rather not even visit the site in the first place.

[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by aboardRat4 on Sunday May 31, 2026 @09:58PM (#48351831)
>, I'd rather not even visit the site in the first place

Until your bank, airline, and tax ministry start using them.

[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by GoblinSlayer on Monday June 01, 2026 @04:01AM (#48353871)
I vote with my wallet and dump misbehaving banks.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by rplnt on Monday June 01, 2026 @07:23AM (#48355391)
Overwhelming majority of customers doesn't even know they can care. And most of them wouldn't anyway. So your vote doesn't matter to anyone but you, sadly.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by marysol5 on Tuesday June 02, 2026 @06:58AM (#48368559)
"Misbehaving" by protecting themselves
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by account42 on Monday June 01, 2026 @05:43AM (#48354639)
Even more reason to boycott sites using it now.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by tracker1 on Monday June 01, 2026 @07:07AM (#48355259)
If you're willing to do it, a real browser with playwright is enough.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by brookst on Monday June 01, 2026 @08:44AM (#48356095)
Not for high volumes of data.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by tracker1 on Tuesday June 02, 2026 @11:25AM (#48371519)
It is if you're willing to pay the extra overhead. ex: Google and MS both use rendered pages for advanced scraping.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by lobocinza on Monday June 01, 2026 @09:59AM (#48356958)
Playwright isn't sufficient for all cases.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by true_religion on Monday June 01, 2026 @03:32PM (#48361528)
$5 padlocks work against what most website owners care about: the common consumer who is using a different app and seeing their site content with someone else's ads on top of it.
[ Parent | on HN ]