EEVBlog overly zealous user verification

[Grandchuck]

"Grandchuck, jnk0le and 1 Guest are viewing this topic."

  for now

[SiliconWizard]

Sorry, just had to enable Under Attack mode again, expect more captures.

Looks like these bots are on fire lately.

[Benta]

Keep up the good job. 
The extent of this kind of destructive behaviour is stunning.
I can live with the verifications, it's better than having the forum down.

Thanks, mods.

[Randy222]

Yep (36946 Guests are viewing this board).

Uh what? It says “268191 Guests” right now. Hence the server having issues today.

Likely a new group of IPs that Cloudflare hasn't yet identified as being from a proxy net.  It'll settle down eventually.

If IP is used for security, then every public IP is the "proxy net".

At some point, bouncing off some non-service IP (cable modem, etc) will be implemented like seti. It's easy to create a vpn mesh where the client enters in at a few entry points but has millions of exit points.

It's a fruitless endeaver to try and implement security at the routing layer.

[tom66]

If IP is used for security, then every public IP is the "proxy net".

At some point, bouncing off some non-service IP (cable modem, etc) will be implemented like seti. It's easy to create a vpn mesh where the client enters in at a few entry points but has millions of exit points.

It's a fruitless endeaver to try and implement security at the routing layer.

Well, it's how Cloudflare works.

Before Proxynets were common, it was easy enough to just ban a range of IP addresses from a malicious actor.  ISPs would also respond to abuse notifications because they did not want their addresses on a ban list.  Especially as buying IP ranges is expensive.

Now with Proxynets, you can't ban IP addresses because in many cases they came from legitimate users whose systems are being abused, willingly or not, to route this traffic. You can't ban these ranges so easily, as you impact legitimate customers who are hosted by that ISP, and those ISPs can't easily manage this abuse as it is distributed over many actors, many of which do not even know what they have agreed to.

So Cloudflare checks if IPs are in suspect ranges (those get banned straight away, without even a challenge page).  If they are not, then it will decide based on a risk model whether an address needs further scrutiny.  Those will receive a human challenge, which uses JavaScript and various heuristic factors to determine if a user is likely human.

[Berni]

If IP is used for security, then every public IP is the "proxy net".

At some point, bouncing off some non-service IP (cable modem, etc) will be implemented like seti. It's easy to create a vpn mesh where the client enters in at a few entry points but has millions of exit points.

It's a fruitless endeaver to try and implement security at the routing layer.

In the event of a DDoS attack how else would you do filtering other than the IP address?

If you try to actually serve a page to check the user then the DDoS has already achieved what they wanted, put load on your network connection and server.

Yes since proxies are these days hosted at home (be it willingly or botnet victim, or just ISP NAT) that means IPs are less of a definitive identifier. But they are still a very useful identifier since you can't just spoof a IP on the internet without actually having some sort of access to that IP, trying to do so will confuse the routing and make it throw your packets into the void. Before they might just outright ban an entire IP range since these people would usually rent a server with a super fast connection, hence it was a specific ISP range.

These days you have to run statistics on every individual IP address to check for a suspicious traffic pattern. Someone like CloudFlare has a massive amount of traffic route trough them so they can collect a lot of data points on pretty much all the actively used IPs on the entire internet. Hence when someone wants to open your web page they can do a very fast lookup in a table of what that IPs recent history was. If it looks fine the packet can instantly be forwarded on to your actual web server (very important for how much traffic they have to deal with), but when the statistics start looking off they capture the request and serve up the verification page. Failing the verification page puts even more bad rep on your IP.

They can build up historic knowledge of what certain IP ranges look like, so they can identify public proxies or ISP NAT ranges and so classify the statistics appropriately.

Is it perfect? Certainly not, but it is a very fast first layer of defense to filter down the traffic for all the more advanced methods that follow.

Problem is that on a small website a legitimate user refreshing the page to try and get in can be identified as a bot. Just because they pass verification one does not mean you can trust them. Botnet operators are smart and might switch to more high effort methods of actually rendering the page in a browser to mimic a user or even develop automated captcha solvers so that the IPs they do control don't fall too low in reputation. They want to keep the IPs reputation just high enough where they can keep doing the cheap fast raw HTML only grabs

[Halcyon]

If you try to actually serve a page to check the user then the DDoS has already achieved what they wanted, put load on your network connection and server.

The check is done prior to hitting the EEVblog server. This is why services such as Cloudflare have massive backhaul connections (measured in Tbps). They can handle the inbound traffic. About 96-97% of DDoS attacks are less than 500 Mbps in "size".

[Berni]

Yep exactly, since that's the point of CloudFlare.

So in order to have that work they have to be able to make a very quick decision on every connection that comes in. The TCP SYN packet is the first thing that will come trough and that mostly just shows the source IP address. If they want they can also acknowledge it and wait for the HTTP request headers to come in before they let that connection onto the real webserver. So that let's them inspect the basic metadata like the user agent and such. That's the last chance they have to redirect a malicious request into the verification page.

So yes they can have a bit more info than just the IP, but the HTTP headers are trivial to fake, it is the first thing you do when writing a scraper script. Even decades ago webservers tended to check these header contents and shooo you off if you didn't look like a browsers header.

[Langdon]

Cloudflare is kinda irritating sometimes, but it's easy and it mostly just works.

It gets the job done—the CloudFlare way.

Their DNS chacing and stuff does improve speed.

Their CAPTCHA leaves much to be desired.

[BrianHG]

Over that past 2 days, I get bot checked every 10 minutes. 
Last week was fine where I would only be bugged once every few hours offline.
My IP address has been fixed for the last 3 months, so, no one else is using it...

[EEVblog]

Over that past 2 days, I get bot checked every 10 minutes. 
Last week was fine where I would only be bugged once every few hours offline.
My IP address has been fixed for the last 3 months, so, no one else is using it...

I don't have that problem, and I'm using a VPN.
Anyway, Under Attack mode is now off, Precursor mode is now on.

[amyk]

These "bot checks" are really more of a "how much you blindly follow", which is IMHO why they are just an excuse to strengthen the browser monopoly and try to force you into compliance, their end-goal being an Internet that can only be usable with officially sanctioned hardware and software containing the latest in spyware. The random DDoSes and scapegoating AI are merely their way of attempting to manufacture consent.

As long as CF thinks this human who uses a rather customised system is not a human, then so be it - like I have done with other sites, I will not be visiting this one either.

[asmi]

It works OK when I access the forum from my cell phone or home internet, but when I try to do it from work, I get a checkbox what feels like every 10 or so minutes.

[EEVblog]

It works OK when I access the forum from my cell phone or home internet, but when I try to do it from work, I get a checkbox what feels like every 10 or so minutes.

Under Attack mode was turrned off yesterday, is it any better today?
Are you using a VPN?

[m k]

No verification here.

But first reply click was mute, maybe its something else.

[tooki]

At some point, bouncing off some non-service IP (cable modem, etc) will be implemented like seti. It's easy to create a vpn mesh where the client enters in at a few entry points but has millions of exit points.

That “some point” is several years ago. Residential proxy services are readily available and easily used for nefarious purposes: https://labs.cloudsecurityalliance.org/research/csa-research-note-residential-proxy-botnet-ecosystem-2026081/

And yes, if you want in on the action, you can install the endpoint software on your computer and let them pay you a few cents per GB of traffic…

[Langdon]

All good today!
(October 3 23:45 UTC)

[Randy222]

Under Attack mode was turrned off yesterday, is it any better today?
Are you using a VPN?

Why divulge the state of the security control? It's like saying "we the bank sent home one security guard because he's not needed right now".

Better to say "we've been tuning our Attack Mode feature, is it any better today?".

[EEVblog]

Under Attack mode was turrned off yesterday, is it any better today?
Are you using a VPN?

Why divulge the state of the security control? It's like saying "we the bank sent home one security guard because he's not needed right now".

Better to say "we've been tuning our Attack Mode feature, is it any better today?".

Because it's not the big security deal you think it is.

[Berni]

Yeah captchas are more of a bot crowding solution, not a security solution.

No captcha is going to stop a hacker. It merely raises the effort bar for bots in order to make them give up.

So it is more like a bank saying "We are really busy right now, so we are only taking customers that need large transactions" and then afterwards saying "We are taking all customers again"

[jpyeron]

if it helps.

Sorry, just had to enable Under Attack mode again, expect more captures.

I just got this:

Bad gateway Error code 502 Visit cloudflare.com for more information. 2026-10-05 14:35:53 UTC
www.eevblog.com Host Error
Cloudflare Ray ID: a45d27cccfe1a5ff

[Randy222]

Yeah captchas are more of a bot crowding solution, not a security solution.

No captcha is going to stop a hacker. It merely raises the effort bar for bots in order to make them give up.

??
Captchas are indeed a tool in the "security" toolbox. They provide a barrier for detecting human input vs automated input.
Captchas were always trailing tools, and always will be.
Captchas are useless given current state of AI ability. Can't even use audio like "click the animal that makes this sound".

The best a captcha does these days, is be a nuisance to the actual human users, and, may weed out some low-end bots.

[Geoff-AU]

The best a captcha does these days, is be a nuisance to the actual human users, and, may weed out some low-end bots.

Agreed.  I feel like Cloudflare's "click this box" is...  let's just say a very very low bar for a bot to evade.  I'm sure we have a sea of bots that are just running curl scripts but having a checkbox is stupid.  Having a captcha that makes me click all squares with motorbikes in it is almost as stupid - particularly since they're statistically-driven and I usually have to do them incorrectly (skipping the boxes with only a small portion of tyre or handlebar, for instance) in order to "pass" the captcha.

[aeg]

I usually have to do them incorrectly (skipping the boxes with only a small portion of tyre or handlebar, for instance) in order to "pass" the captcha.

Those get on my nerves too. Select all the images with cars... is a pickup truck a car? Select all the squares with traffic lights... is a walk/don't walk indicator a traffic light? Does it still count if it's the back of a traffic light? Should I click the tiny, barely visible one way in the background, or just the big ones in the foreground? Then sometimes I'm absolutely sure I got it right, and it flunks me anyway, maybe because it got some other signal it didn't like.

I have to admit I like some of the ones from T*mu. Click all the cetacean mammals whose binomial names don't contain a glottal consonant. It's a captcha and an IQ test. eB*y tried the same thing but screwed it up. They have one which was select the items that go in a refrigerator. One of them was a fried egg. Besides the cultural divide on whether eggs go in the refrigerator, it's a freshly prepared meal that doesn't do well as a leftover. It doesn't go in the refrigerator, it goes in your stomach. But no, if you don't click that one, you get it wrong.

[Monkeh]

Besides the cultural divide on whether eggs go in the refrigerator

Is that a matter of culture, or economic decision making at the expense of the consumer? Or are they one and the same?