Cloudflare Verification Loop issues

[Sessh]

That betus page still works for me. Once the CF check finishes loading and I get the checkbox, clicking it works fine. No looping.

Clipboard01.jpg

[aliex]

I suddenly started having issues with fanfiction.net again (loop and unresponsive browser), but in clean profile everything was fine. Then I noticed that I do not have last update (I was on 33.6.0.1), and after update everything magically returned to normal. Whatever hack they applied to take Pale Moon int account, it seems it is not reliable at all

[back2themoon]

Is using the very latest version a requisite for them? That doesn't sound too unreasonable, although some leeway is obviously necessary.

I don't know how they handle mainstream browsers in this respect.

[BenFenner]

Is using the very latest version a requisite for them? That doesn't sound too unreasonable, although some leeway is obviously necessary.

If the goal is to differentiate between human users and otherwise, a version requisite is completely asinine.

[Moonchild]

If the goal is to differentiate between human users and otherwise

They conflate that with trying to differentiate between different pieces of software connecting to their systems.
I've mentioned before they should use behavioural analysis based on the traffic they receive instead of discriminatory client checks. But they simply aren't and seem in no hurry to start using actually effective traffic-based methods.

[Moonchild]

I don't know how they handle mainstream browsers in this respect.

Supported browsers

If your visitors are using an up-to-date version of a major browser — such as Chrome, Firefox, Safari, Microsoft Edge, Chrome and Safari on mobile — they will receive the challenge correctly.

Challenges are not supported by Microsoft Internet Explorer.

If your visitors encounter issues using a major browser besides Internet Explorer, they should upgrade their browser.
Browser extensions

If you have browser extensions, they might lead to unpassable challenge loops. To fix, disable your extensions and reload the page.

...for whatever arbitrary decisions of what "up-to-date" and "major browser" means for them. Preferably in a non-extended, factory configuration.

[back2themoon]

If an older browser version is deemed insecure (for not having received security updates), would it fail Cloudflare checks? Does this fall under their security check umbrella, or is it "just" humans vs. non-humans?

It'd be good to understand if it's about known browser security issues too, or just version "oldness" e.g. last 2-3 versions are always allowed by CF.

[Pelican]

I built an "unofficial" version (UXP 33.7.0a1) that does not include "Pale Moon" in the user-agent and it still hangs on the betus.com link just like it did weeks ago.

I noted that there was a preference difference between this version and one dated 2025-02-17...

Code: Select all

pref("security.csp.reporting.enabled", false);

Dunno if that setting means anything but it looks like they may have applied an exemption based on user-agent only.

[Moonchild]

I disabled the csp reporting because it caused out-of-memory issues due to cloudflare's check-looping. (Thanks to roytam1 for finding that workaround)

[sindi]

Palemoon 33.6.1 now logs into callcentric.com and fastmail.com but still does not work with the profile editor for my account at exchange.seedsavers.org

[dtoxic]

https://www.portablefreeware.com/ the page gets refreshed to infinity never passing the CF check,just adding this to the other pile of websites.

[Sessh]

I can load that page without hitting a CF check at all.

[dtoxic]

Yeap,just checked and now i could to,this is starting to get frustrating.

[back2themoon]

Worked fine here. Did loop a bit more than usual, but eventually it passed with no action needed.

[Mike_Walsh]

I haven't been on the Forum for a few weeks. Saw the thread about the v33.6.1 changes, and thought I'd try signing-in to my a/c at BleepingComputer.com. Bingo!

Everything's working now.....and passes me thru the 'turnstile' with no fuss at all. According to Grinler - Lawrence Abrams - he's made no changes to the CloudFlare config at his end, so well done - and a BIG "Thank you!" - to whoever's responsible.

Cheers!


Mike.

[BenFenner]

Don't get too excited. It is a temporary reprieve.

[Moonchild]

Everything's working now.....and passes me thru the 'turnstile' with no fuss at all. According to Grinler - Lawrence Abrams - he's made no changes to the CloudFlare config at his end, so well done - and a BIG "Thank you!" - to whoever's responsible.

It passes through because CloudFlare, as Michael relayed, has made a change to whitelist Pale Moon, subject to their sole discretion - if they decide that the whitelist entry is causing "bad traffic" they might immediately block us again without warning. We've also been given pretty much a deadline in June to implement several changes in the platform to cater to their "challenges" or we may once again be blocked. So it's really nothing to celebrate or thank anyone for, as it's just a "hall pass" of sorts, not a solution.

[frostknight]

It passes through because CloudFlare, as Michael relayed, has made a change to whitelist Pale Moon, subject to their sole discretion - if they decide that the whitelist entry is causing "bad traffic" they might immediately block us again without warning

Its better than nothing for sure though. I didn't think cloudflare employees would even acknowledge palemoon being discriminated enough even with bad press.

[Moonchild]

even with bad press

It's not just bad press. Moonchild Productions is a business (even though sole proprietorship). We've been damaged by their shenanigans, even now, which means it could go into (potentially class-action) litigation as well, beyond PR. Not that I want this to happen, but there's definitely an issue there that is more serious than just bad press, especially since it not just impacts us, but a swath of other smaller browsers.
I measured from our blocklist logs right before this started, we had around 350,000 daily active users, with some caveats to that number (as explained in that post) but it's fairly consistent of a metric.
Right now, measured the exact same way, over the exact same days of the week, at the end of March to have given it some recovery time (so giving CF as much benefit as possible), we're now sitting at approx. 318,000, with the exact same caveats. So even with our whitelisting and resulting bypass, we've lost about 32,000 daily active users because of 1.5 months of denial-of-service to our users for many sites, or almost 10%. Mind you, I don't blame our users, at all, for leaving Pale Moon if they can't access the web through it (because it's its primary purpose), and that damage has real impact on finances as a good portion of our support is still greatly dependent on search revenue from active users; only about 0.01-0.02% (it varies) of users provide direct monthly support to the project, everyone else is just using it for free with no compensation whatsoever, so yes, we're still heavily dependent on how many users are actually using the browser for their searches through DDG. We've got almost no wiggle room, as a result.

[Goodydino]

I don't know how they handle mainstream browsers in this respect.

Supported browsers

If your visitors are using an up-to-date version of a major browser — such as Chrome, Firefox, Safari, Microsoft Edge, Chrome and Safari on mobile — they will receive the challenge correctly.

When they say "up-to-date", they mean extremely so. Vivaldi is a chromium browser, but it claims to be Chrome 128. The current version of Chrome is 136. Cloudflare says that Vivaldi is out-of-date.