Cloudflare Verification Loop issues

[KlarkKentThe3rd]

4chan works now

[back2themoon]

Things have indeed improved on some websites. We'll wait for the final fix.

[LuftWafflePilot]

Any update?

Michael Tremante and myself have been working on trying to set up a workable environment (including 5 community core members who indicated they are interested in being part of the discussions to solve this) to both discuss short-term solutions to CloudFlare's current issues and longer-term ideas to have CloudFlare work with not only us but also other independent browser developers to prevent unnecessary issues with CloudFlare's "bot detection". It's taking more time than I would like for the short term, but perhaps with the information provided to them so far, they will solve these issues in a way that will stop the captcha hangs and looping soon. Let's just say if not by the end of this week I'll be rather upset.

I think it's a win if the outcome is problem solved in the long term.

[flamelord]

4chan works now

It's been giving me more shit recently actually.
CF captcha showing more often which is forcing me to toggle security.csp.enable off and on again to trick it into fucking off.

[flamelord]

Michael Tremante and myself have been working on trying to set up a workable environment (including 5 community core members who indicated they are interested in being part of the discussions to solve this) to both discuss short-term solutions to CloudFlare's current issues and longer-term ideas to have CloudFlare work with not only us but also other independent browser developers to prevent unnecessary issues with CloudFlare's "bot detection". It's taking more time than I would like for the short term, but perhaps with the information provided to them so far, they will solve these issues in a way that will stop the captcha hangs and looping soon. Let's just say if not by the end of this week I'll be rather upset.

Thanks for the update.

[Sessh]

Michael Tremante and myself have been working on trying to set up a workable environment (including 5 community core members who indicated they are interested in being part of the discussions to solve this) to both discuss short-term solutions to CloudFlare's current issues and longer-term ideas to have CloudFlare work with not only us but also other independent browser developers to prevent unnecessary issues with CloudFlare's "bot detection". It's taking more time than I would like for the short term, but perhaps with the information provided to them so far, they will solve these issues in a way that will stop the captcha hangs and looping soon. Let's just say if not by the end of this week I'll be rather upset.

That's great! Don't get too upset, I know it's frustrating for all of us, but at least they seem to be making a real effort regardless of why they're forced to come to the table now. They acted poorly, but maybe this is the start of just the kind of working relationship that could prevent future issues. It's a good thing. Be upset with them if it falls apart and they walk away. hehe Great news.

[Tharthan]

Moonchild, I must say that I am delighted to hear that progress is being made on this serious issue.

Thanks for telling us!

[Kand_in_Sky]

Things have indeed improved on some websites. We'll wait for the final fix.

Me only noted that the "stuck here? send feedback" field does not longer pop-up, that's the only one "improvement".
Cloudflare will not understand to code a clean code that works on any browser, they will simply say "PM is outdated, use Chrome lol" and repeat those argument on any other browser.
The company is too big and too fat to change, with money from Google and Microsoft, which means the us-goverment has hands in it. No way the gonna change they behaviour, until they go bankrupt.
Yes maybe, this time will it work... again, until the next update. Then we can continue this thread in 2027 or so.

edit
4chan use now hCaptcha, no wonder it works
edit2
no, must correct myself, it still use cloudfart, it stucks and CPU goes up to 99% and btw no posts with "native" browser agent id.

[franstam]

just to add, thorium browser, a fork of chromium, is giving me exactly the same issue as Pale moon.

www.steamdb.info is looping the check also with thorium browser Version 130.0.6723.174.

according to their github issue raised, enabling hardware acceleration fixed this issue on thorium's end, which i can confirm.
https://github.com/Alex313031/thorium/issues/946

not sure why hardware accel has anything to do with resolving it for thorium.

sigh... thanks alot CF...

[vannilla]

not sure why hardware accel has anything to do with resolving it for thorium.

I wouldn't put past them to measure the time it takes for something to produce a certain result, classifying slow agents as undesirable. It would mean that enabling acceleration on a sufficiently old device would not actually fix anything.

[Moonchild]

I wouldn't put past them to measure the time it takes for something to produce a certain result, classifying slow agents as undesirable.

More likely, they do some convoluted WebGL checking which might fail if HWA is off.

I'm curious now what the full list of affected browsers is (classified "weirdo" or not). So far, in my understanding:

• Pale Moon
• Basilisk
• Waterfox
• Falkon
• SeaMonkey
• Various Firefox ESR flavours
• Thorium (on some systems)
• Ungoogled Chromium
• K-Meleon
• LibreWolf
• MyPal 68
• Otter browser
• Vivaldi

=Added based on below comments
I'd like to know if others are affected too. The longer this list is, the more compelling of a story it will be for the press to keep shining a light on what they are doing to the web.

[Pelican]

I'd like to know if others are affected too.

I have been researching fingerprinting which is something that CF is bound to be using. The short of that is that I found that fingerprinting requires a web browser that allows JavaScript to be run because without JS, browser and device particulars such as graphics card cannot be determined, ie: no fingerprint at all. Of all the bots trying to exploit WordPress on a website that has never used WordPress, I found that apart from my own tests, only one could be fingerprinted.

Consequently we have been developing fingerprinting that doesn't rely on JavaScript. We have been logging those bots and are getting unique signatures for most. The ones that fail will be blacklisted automatically.

To test properly I have reviewed some 20 web browsers, including some that claim to prevent fingerprinting. As Pale Moon has the ability to confound fingerprinting by randomly spoofing JS responses, I can assume that most here will understand how that process works.

With such things in mind, could it be that the failure to be fingerprinted is what might be causing the CF verification failure?

Just a thought.

[Moonchild]

fingerprinting

I honestly don't care how various browsers are being fingerprinted in this context. Requiring a repeatable polyfactor fingerprint should not be part of CF's "bot detection", either.
What CF should be doing instead is use other factors that will quickly weed out the bots. If I, as a human admin, can immediately see what is bot traffic by glancing sideways at an http log, without even looking at user-agents (that are commonly spoofed anyway), then any half-way smart proxy should be able to do the same thing. And a proxy is exactly what cloudflare is.

[billmcct]

I'm curious now what the full list of affected browsers is (classified "weirdo" or not). So far, in my understanding:

• Pale Moon
• Basilisk
• Waterfox
• Falkon
• SeaMonkey
• Various Firefox ESR flavours
• Thorium (on some systems)
• Ungoogled Chromium

I'd like to know if others are affected too. The longer this list is, the more compelling of a story it will be for the press to keep shining a light on what they are doing to the web.

I can add two to the list:
K-MeleonPortable wont even show the captcha and wont allow login without it
LibreWolfPortable wont even show the captcha and wont allow login without it

[billmcct]

Here's another two:
MyPal 68 Portable shows the captcha with the endless loop
OtterBrowserPortable wont even show the captcha and wont allow login without it

[LifeGoesOn]

I'm curious now what the full list of affected browsers is (classified "weirdo" or not). So far, in my understanding:

• Pale Moon
• Basilisk
• Waterfox
• Falkon
• SeaMonkey
• Various Firefox ESR flavours
• Thorium (on some systems)
• Ungoogled Chromium

I'd like to know if others are affected too. The longer this list is, the more compelling of a story it will be for the press to keep shining a light on what they are doing to the web.

I can add two to the list:
K-MeleonPortable wont even show the captcha and wont allow login without it
LibreWolfPortable wont even show the captcha and wont allow login without it

Is there a test site that the above is based on?
I use ungoogled, LibreWolf, Pale Moon (all portable) and using https://community.cloudflare.com/t/acce ... /764330/11 only Pale Moon hangs.

[Goodydino]

I'm curious now what the full list of affected browsers is (classified "weirdo" or not). So far, in my understanding:

• Pale Moon
• Basilisk
• Waterfox
• Falkon
• SeaMonkey
• Various Firefox ESR flavours
• Thorium (on some systems)
• Ungoogled Chromium
• K-Meleon
• LibreWolf
• MyPal 68
• Otter browser

=Added based on below comments
I'd like to know if others are affected too. The longer this list is, the more compelling of a story it will be for the press to keep shining a light on what they are doing to the web.

You can add Vivaldi to that list. It is a chromium browser, but Cloudflare declares it to be "out of date".

[billmcct]

I'm curious now what the full list of affected browsers is (classified "weirdo" or not). So far, in my understanding:

• Pale Moon
• Basilisk
• Waterfox
• Falkon
• SeaMonkey
• Various Firefox ESR flavours
• Thorium (on some systems)
• Ungoogled Chromium

I'd like to know if others are affected too. The longer this list is, the more compelling of a story it will be for the press to keep shining a light on what they are doing to the web.

I can add two to the list:
K-MeleonPortable wont even show the captcha and wont allow login without it
LibreWolfPortable wont even show the captcha and wont allow login without it

Is there a test site that the above is based on?
I use ungoogled, LibreWolf, Pale Moon (all portable) and using https://community.cloudflare.com/t/acce ... /764330/11 only Pale Moon hangs.

Yes, however It is a login site:
https://www.betus.com.pa/authentication/login?msg=7

[Gemmaugr]

So, it seems that Cloudflare has removed https://community.cloudflare.com/t/acce ... /764330/12 (The one that appeared in https://www.theregister.com/2025/03/04/ ... _browsers/)

Might be time to archive the rest of the threads showing how they've restricted PM (and other browsers) in the past.

[Moonchild]

So, it seems that Cloudflare has removed https://community.cloudflare.com/t/acce ... /764330/12

Might be time to archive the rest of the threads showing how they've restricted PM (and other browsers) in the past.

So now they're flat-out removing community threads? ... Yeah archiving the threads is a good idea.

Oh..

Oops! That page doesn’t exist or is private.

probably the latter.
Unfortunately archive.org doesn't have a capture of the live thread either.