Cloudflare Turnstile fails browsers that block WebGL fingerprinting

The loop

Cloudflare Turnstile, the widget that asks visitors to verify they are human, has been looping indefinitely for about a week in a WebKitGTK-based browser, writes the author of the hacktivis.me blog. The failure has been blocking access to a fair number of websites, and the situation has got worse lately. The cause, according to the post, is that Turnstile wants a fingerprint of the device through WebGL — something the author says has no purpose other than tracking.

Cloudflare's own explanation

The post quotes the notice Turnstile shows to affected visitors: “Turnstile uses browser fingerprinting to verify you're human. Privacy tools that block or randomize fingerprinting make your browser look like a bot trying to hide its identity. Temporarily allowing fingerprinting for this site will fix the issue.” Such fingerprinting has been blocked in WebKit for years, the author notes — aggressive enough that even Apple blocks it — and it is not the kind of privacy protection that can easily be switched off in the engine. The practical result, he concludes, is that Cloudflare has banned all WebKitGTK browsers, presumably leaving an exception for Safari.

Firefox's half-fix

As an aside, the post points to a Mozilla bug report, Bugzilla#1916271, which records that Gecko reveals sanitised GPU characteristics to websites, while WebKit and Blink return hardcoded strings to all users. The author also observes that privacy.resistFingerprinting is not enabled even when the strict enhanced privacy protection option is selected in Firefox's settings. With that setting turned on, he suggests, privacy-conscious Firefox users may find that they cannot pass Cloudflare's device verification in the future.

Why it matters

The episode illustrates a wider trade-off: bot detection that depends on device fingerprinting puts browsers with strong privacy protections in the position of looking like bots. The author has written before about blocking Cloudflare's IP ranges, and treats this as a further step in the same direction. His claim is narrow and specific — that the WebGL requirement is fingerprinting for tracking rather than verification, and that users of a widely used open-source engine are the ones paying for it.