4 ms·

"Trouble with Cloudflare" Treating TOR traffic the same as non-TOR traffic makes no sense; read the main link for confirmation they do. Case in point, and for

by nxzero 11y ago

"Trouble with Cloudflare" Treating TOR traffic the same as non-TOR traffic makes no sense; read the main link for confirmation they do. Case in point, and for starters, STOP repeatively requiring a user from a session to keep passing "I'm not a robot" tests. Set a global cookie that's valid for the session, across all of Cloudflair's network, and honor it. If the "I'm not a robot test" doesn't work unless it's repeatively given, then that is the problem, not TOR. Please address this issue; thanks.

x1798DE 11y ago
That wouldn't really help much, because then a bot owner just needs to solve one CAPTCHA, receive the "I'm not a robot" cookie, then hand it over to their bot.
- nxzero 11y ago
  Right, which is the issue, CAPTCHA's don't work.
  - noxToken 11y ago
    Disagree. They don't work if you only show one CAPTCHA. Your proposal defeats the entire purpose, because it only takes human interaction once to defeat CAPTCHA over CloudFlair's entire network. CAPTCHA isn't a silver bullet, and I don't think anyone is lauding it as the end-all be-all to stop spammers and malicious activity.
    - nxzero 11y ago
      Have you used TOR and experienced what Cloudflair does? The server 3-10 tests per page requested in some instances collecting massive amount to training data; I'd in fact be suprise do if Google doesn't place an incentive on collecting as much data as possible; likely enough to ID a user 99% of the time based on the input provided by the user. As for it not being a silver bullet, it's well known that CAPTCHA don't stop bots, but mine data from people. There's not a single Google "I'm not a robot" that can't easily be circumvented, I just know most TOR users aren't able to and Google & Cloadflair are exploiting this.
alex_duf 11y ago
If you set a global cookie, then someone intercepting the public traffic (think NSA, GCHQ,...) can identify what the user is reading. You just killed anonymity.
- nxzero 11y ago
  Global cookie is a session, if the user wipes the cookie, resets the TOR connection, etc. that's their issue. TOR is not designed to hide sessions, nor would setting a global cookie break anonymity unless the user doesn't understand how TOR works. All exit nodes are watched and session device fingerprints are correlated with or without a global cookie.
  - ikeboy 11y ago
    If nobody set a global cookie, a passive attacker cannot correlate different tabs using different circuits. See https://trac.torproject.org/projects/tor/ticket/3455 https://trac.torproject.org/projects/tor/ticket/3455 and https://www.torproject.org/projects/torbrowser/design/#identifier-linkability https://www.torproject.org/projects/torbrowser/design/#ident...
    - nxzero 11y ago
      If the same global cookie is accessible via two circuits, that a bug in a product that uses TOR, not TOR; I personally go above and beyond simply creating a new circuit, never open two circuits at the same time or boot, limit TOR sessions to single use, and locally compartmentize data per session, etc. TOR is not plug in play, it takes effort and discipline, and will never be a fully automated solution.
      - ikeboy 11y ago
        Yes, TBB on default settings is vulnerable to associating multiple tabs (if I'm reading the link above right), if an adversary sets a shared cookie. That does not mean it's ok for someone to set a shared cookie. The possibility of exploitation does not mean exploitation or making exploitation easier is fine.

by nxzero 11y ago

x1798DE 11y ago

That wouldn't really help much, because then a bot owner just needs to solve one CAPTCHA, receive the "I'm not a robot" cookie, then hand it over to their bot.

nxzero 11y ago
Right, which is the issue, CAPTCHA's don't work.
- noxToken 11y ago
  Disagree. They don't work if you only show one CAPTCHA. Your proposal defeats the entire purpose, because it only takes human interaction once to defeat CAPTCHA over CloudFlair's entire network. CAPTCHA isn't a silver bullet, and I don't think anyone is lauding it as the end-all be-all to stop spammers and malicious activity.
  - nxzero 11y ago
    Have you used TOR and experienced what Cloudflair does? The server 3-10 tests per page requested in some instances collecting massive amount to training data; I'd in fact be suprise do if Google doesn't place an incentive on collecting as much data as possible; likely enough to ID a user 99% of the time based on the input provided by the user. As for it not being a silver bullet, it's well known that CAPTCHA don't stop bots, but mine data from people. There's not a single Google "I'm not a robot" that can't easily be circumvented, I just know most TOR users aren't able to and Google & Cloadflair are exploiting this.

alex_duf 11y ago

If you set a global cookie, then someone intercepting the public traffic (think NSA, GCHQ,...) can identify what the user is reading. You just killed anonymity.

nxzero 11y ago
Global cookie is a session, if the user wipes the cookie, resets the TOR connection, etc. that's their issue. TOR is not designed to hide sessions, nor would setting a global cookie break anonymity unless the user doesn't understand how TOR works. All exit nodes are watched and session device fingerprints are correlated with or without a global cookie.
- ikeboy 11y ago
  If nobody set a global cookie, a passive attacker cannot correlate different tabs using different circuits. See https://trac.torproject.org/projects/tor/ticket/3455 https://trac.torproject.org/projects/tor/ticket/3455 and https://www.torproject.org/projects/torbrowser/design/#identifier-linkability https://www.torproject.org/projects/torbrowser/design/#ident...
  - nxzero 11y ago
    If the same global cookie is accessible via two circuits, that a bug in a product that uses TOR, not TOR; I personally go above and beyond simply creating a new circuit, never open two circuits at the same time or boot, limit TOR sessions to single use, and locally compartmentize data per session, etc. TOR is not plug in play, it takes effort and discipline, and will never be a fully automated solution.
    - ikeboy 11y ago
      Yes, TBB on default settings is vulnerable to associating multiple tabs (if I'm reading the link above right), if an adversary sets a shared cookie. That does not mean it's ok for someone to set a shared cookie. The possibility of exploitation does not mean exploitation or making exploitation easier is fine.