Cloudflare Verification Loop issues

[Pelican]

Testing https://www.betus.com.pa/authentication/login?msg=7

* JavaScript and Cookies need to be enabled.

OK Windows browsers:
====================
Chromium
Epic
Indium
LibreWolf
Mullvad
Opera Air
Tor
Vivaldi
Waterfox

Note:
======
Pale Moon and UC browser hide the captcha check (no go).

[Gemmaugr]

So, it seems that Cloudflare has removed https://community.cloudflare.com/t/acce ... /764330/12

Might be time to archive the rest of the threads showing how they've restricted PM (and other browsers) in the past.

So now they're flat-out removing community threads? ... Yeah archiving the threads is a good idea.

Oh..

Oops! That page doesn’t exist or is private.

probably the latter.
Unfortunately archive.org doesn't have a capture of the live thread either.

I managed to save a bunch, and archive a few not existing on Archive.Org. Sadly, the very link we need doesn't exist anywhere..

https://web.archive.org/web/20240428195 ... ken/381029

https://web.archive.org/web/20240428201 ... ion/381829

https://web.archive.org/web/20240428200 ... 029?page=2

https://web.archive.org/web/20220518170 ... ort/382034

https://web.archive.org/web/20231205212 ... ork/518036

https://archive.ph/zSIsH

https://web.archive.org/web/20240809002 ... ain/626885

https://web.archive.org/web/20240428201 ... ain/632337

https://web.archive.org/web/20240716022 ... ser/683536

https://web.archive.org/web/20240716122 ... ser/683529

https://web.archive.org/web/20250221101 ... ers/766860

https://archive.ph/gDPU8

https://archive.ph/U4rd1

[Gemmaugr]

They even removed my account that I used to post in that thread with..

[frostknight]

They even removed my account that I used to post in that thread with..

That is a special level of douche. Gotta raise our voices again it seems.

[Night Wing]

The way I see it, Cloudflare is only going to support the Big Four browsers (Chrome, Edge, Firefox, Safari). In my opinion, those people in charge or making decisions on which browsers which they will not support, are as lazy as the day is long.

And I think those "so called meetings" to discuss the specific issues plaguing Pale Moon and other small browsers market share wise, are nothing more than "lip service" by Cloudflare. In other words, the "brush off". Cloudflare is only going to take this issue serious enough is when their clients put pressure on them money wise.

But how to inform their clients? Probably illegal, but the only way is for someone to get hold of Cloudlfare's client list of companies they service and then informing those companies how much money they are paying Cloudflare and how much money they are losing by Cloudflare's policy of denying people using those browsers which Cloudflare blocks, to access their companies website.

I say this because 30 years ago, I was working for a maritime company and we did the same thing above, but it did not involve browsers, but services involving platform supply vessels.

Really got ugly too as it finally wound up in court where the other company lost. But the other company would not change their policy. Stupid bull headed decision on their part, but as they say, "karma is a bitch" since that company went "belly up" 5 years later because that company became a "pariah" in the maritime industry.

[booboobear]

I've been using the newest firefox and run into this cloudflare issue many times. i use the 'disable html5 autoplay' addon and to get cloudflare to work i have to uncheck the disable autoplay box for the web site then it works just fine on all the ones that mess up.

[Sessh]

Moonchild, are you still in conversation with those CF guys? Is that going anywhere interesting?

[back2themoon]

Moonchild, are you still in conversation with those CF guys? Is that going anywhere interesting?

viewtopic.php?f=65&t=32190

[Sessh]

Wow.. did Michael just say he didn't request or expect MC's signature on the NDA when he specifically did in previous communications? Just wow...

[BenFenner]

Yah, at this point I almost wonder if that person even has the authority to represent CloudFlare in any capacity.

As a developer who has worked with many other outfits to reach a goal, this is amateur hour...

[jobbautista9]

He is working under the Product department at Cloudflare: https://news.ycombinator.com/user?id=mstrem

[andyprough]

Just got past a Cloudflare verification check for the first time in months today without using any Firefox cookies or anything. Also, no spike in CPU or memory usage.

Clean profile (with uBlock), going to community.cloudflare.com:

2025-03-19_05-55.jpg

2025-03-19_05-55ii.jpg

============================

No special uBlock rules being used.

[back2themoon]

Confirmed working on all my problem websites.

Since I block some stuff with ηMatrix, I had to allow these two scripts:

challenges.cloudflare.com (we knew this one...)
static.cloudflareinsights.com (not always required)

[Moonchild]

@mstremante indicated they would be rolling out "exception code" today for Pale Moon and Basilisk in the "focus group topic" for this, so this is likely what we are seeing here.

[Drugwash]

Code: Select all

Security Error: Content at https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/er9xs/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ may not load data from https://example.org/.

Timestamp: 19.03.2025 13:41:19
Error: [Exception... "Component returned failure code: 0x80004002 (NS_NOINTERFACE) [nsIWebProgress.DOMWindow]"  nsresult: "0x80004002 (NS_NOINTERFACE)"  location: "JS frame :: chrome://browser/content/browser.js :: onStateChange :: line 11130"  data: no]

Error above pertains to the AHK board page. The one below pertains to GitLab.

Code: Select all

Timestamp: 19.03.2025 13:48:24
Warning: The character encoding of a framed document was not declared. The document may appear different if viewed without the document framing it.
Source File: blob:https://challenges.cloudflare.com/1cbff033-0888-4637-816b-764312a3314e
Line: 0

Timestamp: 19.03.2025 13:48:25
Warning: Error: WebGL: Failed to create WebGL context: WebGL is currently disabled.
Source File: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=922cbd7ffee06afa&lang=auto
Line: 1

Security Error: Content at https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/wsqba/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ may not load data from https://example.org/.

Timestamp: 19.03.2025 13:48:27
Error: [Exception... "Component returned failure code: 0x80004002 (NS_NOINTERFACE) [nsIWebProgress.DOMWindow]"  nsresult: "0x80004002 (NS_NOINTERFACE)"  location: "JS frame :: chrome://browser/content/browser.js :: onStateChange :: line 11130"  data: no]

Timestamp: 19.03.2025 13:49:03
Error: NetworkError: A network error occurred.
Source File: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=922cbd7ffee06afa&lang=auto
Line: 1

Timestamp: 19.03.2025 13:49:03
Error: TypeError: k[l] is undefined
Source File: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=922cbd7ffee06afa&lang=auto
Line: 1

Cannot log into either www.autohotkey.com/boards or gitlab.com. Tested in troubleshooting mode.
Also tested in normal mode for both sites, with CSP both enabled and disabled. No custom User Agent for either domain, cloudflare domain is allowed.
The https://example.org/ page loads fine when called from the address bar.

Could the network speed be a factor? Mine is limited at around 128kB/s download, 64kB/s upload.
Or did they stonewall (or leave out) certain geolocations...?

[UCyborg]

Their checks are really weird. I tried accessing https://steamdb.info/ with Pale Moon on my old laptop yesterday. The captcha didn't engage. When I accessed the laptop with Remote Desktop and then ran Pale Moon, captcha engaged and just looped. I closed the browser and RDP session and tried accessing directly on laptop, it worked again. Then tried again via RDP, loop.

What gives? Maybe resolution? I used 1920x1080 via RDP while I used native 1366x768 when being on laptop directly. I didn't actually try anything to confirm the theory. But it shows how dumb and arbitrary those checks really are. Maybe something with timings that someone already pointed out when the difference was spotted on one browser between HW acceleration enabled and disabled.

[back2themoon]

No trouble here logging in to:

1. Gitlab
2. http://www.autohotkey.com/boards (actually didn't even get a CF check)
3. https://steamdb.info/

Remember checking and allowing both scripts mentioned above, where necessary.

UCyborg, you said you tried yesterday. Things have changed today.

cloudflare domain is allowed.

If you are only allowing cloudflare.com, it won't be enough. Check the aforementioned scripts.

[Moonchild]

Looks like they are still hard-relying on WebGL being available. That just isn't the case in all installations.
RDP will not have WebGL HWA available which will make their challenges fail in that case. Anyone with a remote or emulated video display will run into this issue.

[Basilisk-Dev]

I mentioned this already in the other thread, but the checks are still broken in Basilisk out of the box.

If I configure Basilisk to send a Pale Moon user agent to challenges.cloudflare.com then it works. I'm guessing they probably didn't test in Basilisk at all and just thought "Hey it works in Pale Moon so it'll work in Basilisk too". In other words, their dev team probably doesn't actually care about us and was just doing the minimum to check off a box so we'd shut up and leave them alone.

I'm going to give Michael at Cloudflare until the end of the day to respond on the other thread and if he doesn't then I will release an update to Basilisk that overrides the useragent for challenges.cloudflare.com to the Pale Moon user agent.

[Moonchild]

I mentioned this already in the other thread, but the checks are still broken in Basilisk out of the box.

That is really disappointing to hear. They obviously whitelisted the Pale Moon UA (and didn't actually address the underlying issue) and despite saying they'd do the same for basilisk, they haven't?

I'm going to give Michael at Cloudflare until the end of the day to respond on the other thread and if he doesn't then I will release an update to Basilisk that overrides the useragent for challenges.cloudflare.com to the Pale Moon user agent.

Yeah, definitely a case of "got to do something".
I'm currently not sure what the impact has been on our usage numbers but I'll do another measure the same way as last time in a week or two to see how many users have left Pale Moon over this 1.5 months of denial-of-access to get a real tangible damage impact.