Cloudflare Turnstile: ηMatrix/uBlock Origin guide for proper function

[back2themoon]

ηMatrix (aka eMatrix):
Make sure you are using the latest version: https://addons.palemoon.org/addon/ematrix/

Its default settings will break Cloudflare's verification process.

1. Go to the extension's "My rules" section.
2. Temporary rules / Press "Edit".
3. Go to end of the existing rules, add a new line and paste the two lines below. Don't overwrite or alter any existing rules. Make sure they are entered as two, separate lines.

Code: Select all

* challenges.cloudflare.com frame allow
* challenges.cloudflare.com script allow

4. Press the "Save" button, then "Commit". If done correctly, they should now also appear on the left "Permanent rules" section. That's it.

====================================

uBlock Origin "Legacy":
Make sure you are using the latest version. UCyborg's fork is currently the recommended one:
https://github.com/UCyborg/uBlock-for-f ... y/releases

If using JustOff's older fork, it's best to fully uninstall it first. Backup your uBO settings, if you want to restore them later. If you are not sure what you are doing, start clean with UCyborg's new fork.

uBO's default settings will not break Cloudflare's verification process. CF breakage is uncommon with uBO and will only occur with:

1) Hard-core filterlists that may block Cloudflare entirely. If such lists are active, they need to be disabled or removed.
2) Certain advanced settings e.g. enabling the so-called "medium mode" and of course the "hard mode". These are not some special modes you can toggle with one click on uBO's UI. They are a combination of non-default settings, to be enabled as described in the linked articles.

If not using such advanced modes, you don't need to do anything on uBO.

If for whatever reason you are using an advanced blocking mode, you need to allow 3rd-party frames and 3rd-party scripts on every website that implents the Cloudflare check. uBO is less flexible and granular for this job than eMatrix. It is recommended to use the latter for this purpose. If you insist on using uBO for this kind of blockage, then:

1. Visit the website that performs the CF check.
2. Make sure to "green" the two indicated boxes below. The ones in the right column, as indicated. The left ones should already be red, if using medium/hard blocking mode: (they are not red in the screenshot below)

uBO.png

3. Repeat steps 1+2 on each website.

On my example, I applied this on the Pale Moon forum (which doesn't use CF - it's just an example). If done correctly, these rules should now appear on uBO's "My rules" section:

Code: Select all

forum.palemoon.org * 3p-frame allow
forum.palemoon.org * 3p-script allow

Of course, the website you added will show up there instead of "forum.palemoon.org".

[andyprough]

I use generic eMatrix and have no such problems and need no such workaround.

[Gemmaugr]

Likewise. I use no special rules for eMatrix or touch uBO. I just manually allow CF (especially frame) each challenge in eMatrix.

I do think I remember that one setting in either eMatrix or uBO could muck it up though. Was it blocking CSP reports?

Maybe we should post screenshots of our settings and filterlists?

[andyprough]

Likewise. I use no special rules for eMatrix or touch uBO. I just manually allow CF (especially frame) each challenge in eMatrix.

Ah, I read the OP wrong, yes I also manually allow Cloudflare in eMatrix when I wish to pass a turnstile. I choose not to give Cloudflare free reign otherwise.

[back2themoon]

Ah, I read the OP wrong, yes I also manually allow Cloudflare in eMatrix when I wish to pass a turnstile. I choose not to give Cloudflare free reign otherwise.

You are not giving Cloudflare free reign. You would be globally only allowing challenges.cloudflare.com, which is exclusively used by the Turnstile. And strictly only what's needed: script and frame. No 3p-cookie.

Sure, you could allow it per website but it's going to be a massive waste of time, and you are not really gaining anything.

It'd only make sense if you visit specific websites and not much else, and if the Turnstile wasn't that widespread.

[back2themoon]

Likewise. I use no special rules for eMatrix or touch uBO. I just manually allow CF (especially frame) each challenge in eMatrix.

So, you do use special rules for eMatrix. 😋

As for uBO, it is mentioned that with its more common default setup, no change is required.

[Gemmaugr]

Likewise. I use no special rules for eMatrix or touch uBO. I just manually allow CF (especially frame) each challenge in eMatrix.

So, you do use special rules in eMatrix. 😋

As for uBO, it is mentioned that with its more common default setup, no change is required.

Fair. They're just not written in, specifically.

(they reason I don't do that is because I want to experience the fatigue of the CF Turnstile Challenge. It motivates me to seek out alternative sites, if they exist. Or just exit away before the browser locks up/freezes for a while).

[andyprough]

Ah, I read the OP wrong, yes I also manually allow Cloudflare in eMatrix when I wish to pass a turnstile. I choose not to give Cloudflare free reign otherwise.

You are not giving Cloudflare free reign. You would be globally only allowing challenges.cloudflare.com, which is exclusively used by the Turnstile. And strictly only what's needed: script and frame. No 3p-cookie.

Sure, you could allow it per website but it's going to be a massive waste of time, and you are not really gaining anything.

It'd only make sense if you visit specific websites and not much else, and if the Turnstile wasn't that widespread.

True, but also when I land on a page that unexpectedly pops up a CF challenge, I like to take a moment and consider whether allowing CF to track me is worth whatever content is on that website. And I often decide that the content is not worth giving CF access to my visit. So I prefer the time wasting method.

[back2themoon]

...I want to experience the fatigue of the CF Turnstile Challenge. It motivates me to seek out alternative sites, if they exist.

That's an interesting scenario, self-inflicted pain!

...when I land on a page that unexpectedly pops up a CF challenge, I like to take a moment and consider whether allowing CF to track me is worth whatever content is on that website. And I often decide that the content is not worth giving CF access to my visit. So I prefer the time wasting method.

This is interesting as well, but one would assume that if you are visiting a website, you'd want to see its content. And if it's not Cloudflare tracking you, then it'd be someone else probably "policing" the website.

Full respect to both scenarios since they are fully privacy-oriented, but clearly this guide is meant for novice/intermediate users, having them make sure they are not blocking Cloudflare themselves (and then complain about it). I believe the guide strikes a good balance between privacy and functionality. Cloudflare is everywhere, whether we like it or not. We are still blocking its tracking scripts.

More advanced, seasoned eMatrix users should already know what they are doing. The even more extreme uBO medium/hard mode users should be even rarer in Pale Moon. We have eMatrix for that kind of usage. Those "crude" uBO modes are now mostly for Firefox/Chromium users who have lost the beauty of uMatrix.

[andyprough]

This is interesting as well, but one would assume that if you are visiting a website, you'd want to see its content. And if it's not Cloudflare tracking you, then it'd be someone else probably "policing" the website.

Not really, often I'll click on some tech journal article on a subject I was searching for, and if I find they are CF protected I'll just go to the next one on the search results list until I find one that gives me the text without requiring interaction with undesirable domains like CF and Google. Same with capchas, I often just stop visiting a site if it institutes capchas. The web is a big place, I have lots of options.

Full respect to both scenarios since they are fully privacy-oriented, but clearly this guide is meant for novice/intermediate users, having them make sure they are not blocking Cloudflare themselves (and then complain about it). I believe the guide strikes a good balance between privacy and functionality. Cloudflare is everywhere, whether we like it or not. We are still blocking its tracking scripts.

I agree with this, and with that novice/intermediate audience in mind your method here has my full support. I think this Tutorial will be very good for new users to eMatrix, which can have a bit of a daunting learning curve for some folks. I recall when I was a new uMatrix user there was a lot of stuff to get used to, and it seemed quite different from the noscript method, but once I got used to it I did not want to go back to using noscript. This is one reason (of many) I prefer to use Pale Moon as my primary browser, is that eMatrix is maintained and improved by @vannilla, whereas uMatrix on Firefox was abandoned by Raymond Hill 5 years ago and has grown stagnant.