4 ms·

1. You may not have Javascript enabled. 2. Doesn't the captcha unlock you for the whole browsing session? 3. Cloudflare is working as intended. They could jus

by rudolf0 11y ago

1. You may not have Javascript enabled. 2. Doesn't the captcha unlock you for the whole browsing session? 3. Cloudflare is working as intended. They could just block Tor outright. I think this is probably the best compromise.

kefka 11y ago
1. I've tried JS on and off, in Tor Browser, and in a proxied stock firefox. 2. No. It's a crapshoot. Sometimes it does, but about >75% of the time, it goes into CAPTCHA loops. 3. There's plenty of things that could be done to alleviate this issue : One, they could set up their own .onion service, and redirect TOR users to it. And that would rate-limit any potential TOR-user based damage. Two, since sessions are per TCP, just slow the TCP down accordingly. That's standard practice for things like tarpits and the like. Three, there's no need for CAPTCHAs on a HTTP GET, if not done in a harassing manner. But this basis is on being in a "Bad IP list". POSTs are a whole different story.
detaro 11y ago
1. Disabling javascript while using Tor is probably a good idea, because it removes a lot of potential risks from the equation. risk vs convenience I guess. 2. In theory yes, in practice that doesn't seem to be the case, with people reporting captcha-loops etc. And everything that allows CF to reliably reidentify the user is at the same time a potential vulnerability of the user. 3. Or they could implement less drastic measures and still protect their customers (e.g. what risk does a GET request against a cached site really pose that requires a captcha?). It's a sliding scale and not obvious what the "best" solution is. There are good arguments in both directions, and Cloudflare is important enough that they IMHO should think further than "what's easiest for us". They seem at least to be somewhat receptive towards arguments about this.

4 ms·

1. You may not have Javascript enabled. 2. Doesn't the captcha unlock you for the whole browsing session? 3. Cloudflare is working as intended. They could jus

by rudolf0 11y ago

kefka 11y ago
1. I've tried JS on and off, in Tor Browser, and in a proxied stock firefox. 2. No. It's a crapshoot. Sometimes it does, but about >75% of the time, it goes into CAPTCHA loops. 3. There's plenty of things that could be done to alleviate this issue : One, they could set up their own .onion service, and redirect TOR users to it. And that would rate-limit any potential TOR-user based damage. Two, since sessions are per TCP, just slow the TCP down accordingly. That's standard practice for things like tarpits and the like. Three, there's no need for CAPTCHAs on a HTTP GET, if not done in a harassing manner. But this basis is on being in a "Bad IP list". POSTs are a whole different story.
detaro 11y ago
1. Disabling javascript while using Tor is probably a good idea, because it removes a lot of potential risks from the equation. risk vs convenience I guess. 2. In theory yes, in practice that doesn't seem to be the case, with people reporting captcha-loops etc. And everything that allows CF to reliably reidentify the user is at the same time a potential vulnerability of the user. 3. Or they could implement less drastic measures and still protect their customers (e.g. what risk does a GET request against a cached site really pose that requires a captcha?). It's a sliding scale and not obvious what the "best" solution is. There are good arguments in both directions, and Cloudflare is important enough that they IMHO should think further than "what's easiest for us". They seem at least to be somewhat receptive towards arguments about this.