search

kkapsner / CanvasBlocker

A Firefox extension to protect from being fingerprinted.
https://canvasblocker.kkapsner.de
Mozilla Public License 2.0
1.12k stars 85 forks source link

Cloudflare Turnstile Issues and a workaround (Firefox about:config) #711

Open spacesynth opened 1 month ago

spacesynth commented 1 month ago

Some foreword

grafik

grafik

https://abrahamjuliot.github.io/creepjs/

Above you see a glitched out Canvas from the stock Firefox canvas protection from resist-fingerprinting. Below you see a nicely rendered Canvas, no artifacting, cc. of Canvas blocker.

The choice should be clear here: Canvas Blocker is protecting the user whilst leaving the content meaningful. Which is why I still give Canvas Blocker my endorsement and love it.

Description

grafik

grafik

https://developers.cloudflare.com/turnstile/

Today I could not enter any Cloudflare Turnstile protected site anymore (above are technical specs). Turnstile is a bot countermeasure that can either be visible as box or 100% hidden from the user in many Wordpress commenting plugins. I was locked out on 6 sites, I couldn't even tell one.

My settings didn't change and a change of IP did nothing either.

Expected Behaviour

The sites should let me access them, I made no changes to my system.

Current Behaviour

Only turning canvas blocker off returned the sites to an accessible state.

Possible Solution

https://github.com/ran-sama/firefox-preferences?tab=readme-ov-file#how-it-works

[
   {
      "firstPartyDomain":"cloudflare.com",
      "overrides":"+AllTargets"
   },
   {
      "thirdPartyDomain":"cloudflare.com",
      "overrides":"+AllTargets"
   }
]

Naturally these granular overrides allow to leave other sites untouched from Firefox's new and highly configurable anti-fingerprinting technology. I can use the strong glitchy built-in Canvas blocking and access a site that is non-cooperative.

Steps to Reproduce (for bugs)

  1. visit site
  2. get locked out
  3. whitelist site in Canvas Blocker
  4. blacklist site in firefox anti-fingerprinting (with their canvas solution)

Context

It affects me emotionally.

Your Environment

Your Settings

it even happened on a clean profile with stock settings of canvas blocker beta

customized: https://github.com/spacesynth/userscripts-collection/blob/2d364214ef55ccbcc9fe5e6831fca16bcd7630a9/addon_settings/CanvasBlocker.json whitelisted: https://github.com/spacesynth/userscripts-collection/commit/83c8f6f11c407ef029ca5bef8497a1bfca935585

What is my message here

Of course keep using Canvas blocker! If you whitelist a website in Canvas blocker, you can still try to blacklist it with Firefox's internal Canvas blocker (messy/glitchy) as a fallback.

kkapsner's Canvas Blocker is superior, but if one doesn't want to accept defeat, there is a fallback that might work.

Wanting privacy is never a bot like behaviour, it is the most human behaviour.

That said, one cannot do much, but oddly if one looks like TOR (uses the Mozilla anti-fingerprinting), they leave us in peace and the turnstile opens.

Canvas Blocker also seems to hide my highly unique screen resolution (1920x1200 @ 16:10) way better, which the Firefox CSSMediaQueries spoofing does not reliably.

Edit: I hope my long-winded rant is not misunderstood. I'm just giving advice how to resist harder and not give up. It's not your addons fault the web is getting broken (on purpose) by tech bros in Silicon Valley.

satoshinotdead commented 1 month ago

Posible duplicated? #710