Cloudflare Verification Loop issues

[Mike_Walsh]

I heard reports of Ungoogled Chromium not working with CF either.

That's probably just because so many distros and platforms use badly outdated builds of ungoogled chromium. I doubt Cloudflare can tell the difference between an up-to-date ungoogled chromium vs the same current version of regular chromium, and it should pass current versions through.

Umm.....nah. I think there's more to it than that, Andy. As it happens, flamelord's right on the money here.

".....it should pass current versions through." Huh. You'd think so, wouldn't you....hm?

I've just upgraded my portable Ungoogled Chromium to the bang-up-to-date, current build. This was built just 2 days ago, OK? It's pulling the same stunt on BleepingComputer as Pale Moon, with one exception; it does bring up the check-box! However, I tick it, and thennn.....straight back to the sign-in page again (and AGAIN). Which begs the question; what does the Google API contain that isn't in UChromium? With the exception of Ungoogled Chromium, most Chromium 'clones' will let you sync to a Google a/c, meaning the Google API has to be present.

Kinda makes me think there's summat in the Google "phone home" stuff that CloudFlare's also 'hooked-into'. What could it be? Any ideas?....'cos that's sorta stumped me, that has. Does Firefox use the Google API?


Mike.

[Moonchild]

Does Firefox use the Google API?

Yes it does. and it uses specific mozilla-release keys that are plugged in at build-time at Mozilla, so not easily discoverable.

[frostknight]

Yes it does. and it uses specific mozilla-release keys that are plugged in at build-time at Mozilla, so not easily discoverable.

Do you know where those keys are located on linux?

Like .mozilla folder, or .cache? And what are they called.

[Mike_Walsh]

Does Firefox use the Google API?

Yes it does. and it uses specific mozilla-release keys that are plugged in at build-time at Mozilla, so not easily discoverable.

Mm. Makes sense, I guess.....after all, I can access my GoogleDrive through Firefox. I can do that in Pale Moon, as well...

Does PM use Google's API?

Mike.

[frostknight]

Does PM use Google's API?

I tend to bout it, in my opinion anyhow

[flamelord]

My question remains unanswered
Why are many random websites that use CF suddenly working but the ones that require the tickbox(like 4chan) still don't?

[KlarkKentThe3rd]

My question remains unanswered
Why are many random websites that use CF suddenly working but the ones that require the tickbox(like 4chan) still don't?

It all revolves around CloudFlare. CF is involved with every case, as the source of the problem.

[Moonchild]

Why are many random websites that use CF suddenly working but the ones that require the tickbox(like 4chan) still don't?

Because CloudFlare's "bot detection development team" is apparently clueless how to do their job properly.

[andyprough]

just upgraded my portable Ungoogled Chromium to the bang-up-to-date, current build. This was built just 2 days ago, OK? It's pulling the same stunt on BleepingComputer as Pale Moon, with one exception; it does bring up the check-box! However, I tick it, and thennn.....straight back to the sign-in page again (and AGAIN).

Really??? I'll have to try it, but that's an odd one. You wouldn't by chance be using an old profile? Maybe an old profile could be a culprit here. But if not, then this is really insidious as you have rightly pointed out.

Update - I downloaded the current ungoogled-chromium 133.0.6943.126-1 AppImage and ran it and couldn't find any Cloudflare challenges that the browser had any trouble with. 4chan worked, community.cloudflare.com, nitter.post.org, science.org, the browser was able to pass all the Cloudflare challenges for those sites without any trouble. What is the problem page for BleepingComputer - I tried different pages and the forum and didn't get any Cloudflare challenges.

[flamelord]

It all revolves around CloudFlare. CF is involved with every case, as the source of the problem.

Because CloudFlare's "bot detection development team" is apparently clueless how to do their job properly.

UPDATE: Random sites that didn't require the tickbox are now looping as well
Like the science.org that I posted earlier
Check this link I picked at random, and you will see that it's looping once again
https://www.science.org/doi/10.1126/sciimmunol.adq4973

EDIT: Nevermind now it fixed itself AGAIN
What the fuck is going on?

[Mike_Walsh]

just upgraded my portable Ungoogled Chromium to the bang-up-to-date, current build. This was built just 2 days ago, OK? It's pulling the same stunt on BleepingComputer as Pale Moon, with one exception; it does bring up the check-box! However, I tick it, and thennn.....straight back to the sign-in page again (and AGAIN).

Really??? I'll have to try it, but that's an odd one. You wouldn't by chance be using an old profile? Maybe an old profile could be a culprit here. But if not, then this is really insidious as you have rightly pointed out.

I pull tricks with my profiles. With Puppy's sym-link function being as versatile and as powerful as it is, I keep a single 'working' profile in an external location, which I 'link' to when normal browsing. For testing purposes, I just unlink this, then let the 'wrapper' launch script create a brand-new one. When I'm satisfied with it, I delete and go back to my 'normal' profile location.

My profiles are never really old, anyway. We have all the portables set up for auto-updating via home-brewed scripts (for the 'zilla-based builds, it tends to be built-in; for the Chromium-based, we built them ourselves), so my profiles never miss a minor version and are pretty much continuous. However, every 8-10 releases or so, I let the 'old' profile lapse, and start from scratch with a new one......not an issue, since a fresh launch will auto-load my bookmarks'n'stuff for me anyway. (I know, I know; I'm a lazy bugger, but I spend a lot of time setting up all this automated stuff initially, in order to make life easier down the line).

Myself, I don't see the sense in going for a brand-new profile with every minor point update. I'm not saying you shouldn't - I know many who prefer to, every time - but I don't. To date, I've had no issues doing this. Perhaps I've been very lucky; I had one Chrome profile that went for seventeen major releases straight, though I know I was "pushing it" with that one!

I create a lot of wee GUIs with YAD, and my Chromium-based browsers all launch with a two-button selector where I can choose a 'normal' session OR a 'test run'. (What can I say? I LIKE my GUIs! Too many years previously with Windows, methinks...)

I do push the boundaries with our Pup, I must admit.

Mike.

[flamelord]

Weird issue I noticed.
Verification loop kept happening on this site.
I pressed block(the red X that alternates with the refresh button) when it was refreshing and it told me to unblock challenges.cloudflare.com to proceed.

Problem: I don’t have it blocked
I did have it filtered on uBlock once a week ago but I removed that from my filter list a while ago

challenges.png

[flamelord]

So apparently that manga site url was not working for me because it was not redirecting to the new URL(vymanga.com)
However why was it showing please unblock challenges.cloudflare.com when I do not have it blocked? Very strange

The site is also saying they are being blocked by Cloudflare due to 3rd party reports

cloudflare.PNG

[BenFenner]

Myself, I don't see the sense in going for a brand-new profile with every minor point update. I'm not saying you shouldn't - I know many who prefer to, every time - but I don't. To date, I've had no issues doing this.

My Pale Moon profiles are all ~10+ years old across dozens of machines. I think I've had to rebuild a profile one time, ever.

[Gemmaugr]

I may be treading old or obvious ground here, but is there a difference in how Pale Moon (and the other CF blocked browsers) do SSL/TLS compared to main chrome/ium and FF?

Seems most of the trouble started after CF added "automatic SSL/TLS"; https://blog.cloudflare.com/introducing ... nectivity/ and sites have the (default?) Full (Strict) setting on.

(Open this link in a CF approved browser or PM with Javascript turned off) https://community.cloudflare.com/t/user ... fox/774524

And/Or maybe how it's tied into CSP and Origin Connectivity? https://community.cloudflare.com/t/veri ... 031/774277 ..Likewise, is that done differently?

https://browseraudit.com/

https://www.browserscan.net/tls

https://browserleaks.com/tls

[Enobarbous]

I've just upgraded my portable Ungoogled Chromium to the bang-up-to-date, current build. This was built just 2 days ago, OK? It's pulling the same stunt on BleepingComputer as Pale Moon, with one exception; it does bring up the check-box! However, I tick it, and thennn.....straight back to the sign-in page again (and AGAIN). Which begs the question; what does the Google API contain that isn't in UChromium?

It may not only be the browser version, but also the hardware it runs on. As my tests showed in the last week on 4 different devices, you have to do more than just pass the CF check: you have to do it in a certain amount of time. If everything that cloudflare does under the hood of the browser while the wheel that says “verifying” is spinning on the screen lasts long enough, then an endless cycle arises: “verifying” - “check the box” - reload page - “verifying”...
I happened to notice this effect on one of my netbooks - it turns out that a dual-core proc and 4gb of ram may not be enough to make cf turnstile work with enough speed to pass the check, on, well, one open page in the browser. Who knew, who knew...

[Geroom]

I can't access metal-archives at all on Pale moon. it loops and sometimes freezes that i have to kill it from task manager but that's probably my pc being weak. However, i can access that site on r3dfox esr just fine.

[cannonmc]

Slowly working my way through my bookmarks
Found two so far
http://tinyurl.com/

https://www.gunviolencearchive.org/

Contacted both, no reply yet from gunviolence

Exchange with TinyURL

Me: Did you that know Cloudflare blocks smaller browsers like Palemoon and
causes them to crash?
When they change their software they only support the four major
browsers and refuse to engage with anyone.

TinyURL> Are you using the most recent version?

Me:Yup. There is an ongoing discussion on the Palemoon forum about how Cloudflare once again only supports the big four browsers and every time they CF
change something they don't update their software and they refuse to engage with those excluded

TinyURL> We were not able to replicate the error that you are getting. And as Kevin pointed out, you may need to update your browser's version in order to view the page properly.
Should you need further assistance, please don't hesitate to contact us.

Me: I am using PaleMoon latest. Did you?
I have forwarded your comment to PaleMoon developer.
Meanwhile I have bitly.com to fall back on

[Mike_Walsh]

I've just upgraded my portable Ungoogled Chromium to the bang-up-to-date, current build. This was built just 2 days ago, OK? It's pulling the same stunt on BleepingComputer as Pale Moon, with one exception; it does bring up the check-box! However, I tick it, and thennn.....straight back to the sign-in page again (and AGAIN). Which begs the question; what does the Google API contain that isn't in UChromium?

It may not only be the browser version, but also the hardware it runs on. As my tests showed in the last week on 4 different devices, you have to do more than just pass the CF check: you have to do it in a certain amount of time. If everything that cloudflare does under the hood of the browser while the wheel that says “verifying” is spinning on the screen lasts long enough, then an endless cycle arises: “verifying” - “check the box” - reload page - “verifying”...
I happened to notice this effect on one of my netbooks - it turns out that a dual-core proc and 4gb of ram may not be enough to make cf turnstile work with enough speed to pass the check, on, well, one open page in the browser. Who knew, who knew...

Here, I have a HP Pavilion desktop rig; 9th-gen Pentium G5400 quad-core (okay, dual-core with H/T), running at almost 4 GHz along with 32 GB DDR4. The CF turnstile in BC passes in every Chromium-based browser except UngoogledChromium, but that's missing the Google API by design.

So, although I would prefer to use PM on BC's site I use Chrome instead......or Opera, or Slimjet, or vanilla Chromium, or Brave, or Iron, etc, etc.

I can do what I need to.....though not in the way that I would like.

Mike.

[Enobarbous]

And/Or maybe how it's tied into CSP and Origin Connectivity? https://community.cloudflare.com/t/veri ... 031/774277 ..Likewise, is that done differently?

This is not the only reason, but CF really doesn't like something about how PM works with CSP. What follows can hardly be called a report, but still:
- browser version: clean portable PM 33.6.0.1.win64
- tested pages https://www.fanfiction.net/s/5645987/1/PRIMARCHS , https://www.gunviolencearchive.org , https://www.science.org/doi/10.1126/sciimmunol.adq4973
So, I noticed that with security.csp.enable=true (as is the default) to the usual cloudlare errors

Code: Select all

v1:1:69622
/.*.*=.*/  
v1:1:69622
/.*.*=.*/  
v1:1:69622
function ()  
v1:1:69622
function ()  
v1:1:69622
<a>  
v1:1:69622
<a>  
v1:1:69622

and

Code: Select all

[k] is not defined

two more are added:

Code: Select all

EvalError: call to eval() blocked by CSP  
v1:1:53996
	ge https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:53996
	ge self-hosted:1077:17
	g8/</</< https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:38642
	g8/< https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:39354
	g8 https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:39384
	g8 self-hosted:1117:17
	ge https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:53996
	ge self-hosted:1077:17
	g8/</</< https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:38642
	g8/< https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:39354
	g8 https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:39384
	g8 self-hosted:1117:17
	ge https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:54019
	ge self-hosted:1077:17
	g8/</</< https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:38642
	g8/< https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:39354
	g8 https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:39384
	g8 self-hosted:1117:17
	ge https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:53996
	ge self-hosted:1077:17
	g8/</</< https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:38642
	g8/< https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:39354
	g8 https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:39384
	g8 self-hosted:1117:17
	ge https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:53996
	ge self-hosted:1077:17
	g8/</</< https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:38642
	g8/< https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:39354
	g8 https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1:1:39384
	g8 self-hosted:1119:17

Error: Script terminated by timeout at:
g8/</</<@https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=91a8d2c4aa26ecdf&lang=auto:1:38682
g8/<@https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=91a8d2c4aa26ecdf&lang=auto:1:39354
g8@https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=91a8d2c4aa26ecdf&lang=auto:1:39384

And the behavior of challenges cloudflare is standard: an endlessly rotating "verifying" circle and periodic serious browser freezes.

But with security.csp.enable=false the behavior is different: first - these errors do not occur (which is logical with csp disabled), secondly - browser freezes are noticeably less and third (and most importantly), there is an option to check the “verify you are human” box.

1.jpg

Yes, there's still an error message afterwards and the challenges page reloads again, but it's still some step forward.

@Moonchild Could it be that the eval() handling rules have been updated and/or some chrome behavior has been promoted back to standard?