5 ms·

I don't know what the solution is here. One of my sites enjoys a ridiculous number of fraudsters trying to make purchases, many - but very much not all - from

I don't know what the solution is here. One of my sites enjoys a ridiculous number of fraudsters trying to make purchases, many - but very much not all - from the tor network. The easy solution is to punish everyone and ban tor exit nodes from access, and woo, a significant reduction in my fraud rate. The way I justify this to myself is that the site only accepts payment via PayPal and/or credit cards, and paying with those in itself gives up a good amount of privacy. For sites that don't make a profit and have to use unpaid time to clean up the mess from some tor nodes, I really don't know what the solution is. It definitely sucks for legitimate users. Edit: one more difficulty is that I don't know if I was targeted by one or two lazy-yet-determined fraudsters who only use tor, and so make tor look worse than it is with their repeated attempts. No idea even where to begin with that one.

jimktrains2 11y ago
Tor can't possibly be the only signal of fraudulent activity though? It may be one that has an easy "solution" however, but one that's easily circumvented (one of the many free VPN services out there).
- mootothemax 11y ago
  >Tor can't possibly be the only signal of fraudulent activity though? Yes and no. Yes: many fraudsters are ridiculously lazy, and fraud rates go down when the tor block is in place. No: plenty of fraudsters access from elsewhere (and I put them through a separate fraud-detection-SaaS)
- nxzero 11y ago
  Signal according to Cloudflare isn't "TOR" but the IP's the are used by TOR exit nodes get banned due to them being shared and abused enough to trigger that IP being tagged as a source of trouble. I personally don't buy this, since I know of IPs they don't block again would get enough abussive traffic to merit the same treatment, but don't get the treatment TOR's IPs get.
  - Kalium 11y ago
    Since you think CloudFlare is lying, what do you think the truth is?
    - nxzero 11y ago
      Not sure, though given enough dialog on the topic, I believe that a better solution will be found or it'll become clear that Cloudflare is not responding to the issue. Simple answer would be that the original analysis is flawed, they've forgotten that the wrote a script to block TOR exit IPs; TOR intentionally provides a list of these IPs to the public. Might be worth noting that TOR users are often the target of National Security Letters, that Cloudflare based on their own report received National Security Letters, and as such, would be unable to say if those letters impacted code on the topic.
      - Kalium 11y ago
        What kind of "better solution" do you envision? Right now you seem to be insisting that there must be one, which I must say does not make a very compelling case that one actually exists or is possible.
        nxzero 11y ago
        Given Cloudflare appears to have received National Security Letters, it's possible their is no answers. That said, based on what I know, the answer is to whitelist the TOR IPs, give TOR users a global session that the user has the option to opt into (likely make sense for TOR publish what the impact of this is and Cloudflare to link to it in from that page) and always let users know a global session is set in case the user believe that using TOR they reset the session; resetting it via Cloudflare would be meaningless. General gist though is humans are not bots, don't behave as bots, and Cloudflare treats ever request as the same from an IP, which is a poor way to block bots.
        pfg 11y ago
        > That said, based on what I know, the answer is to whitelist the TOR IPs That's an option CloudFlare is offering to their customers now. > give TOR users a global session that the user has the option to opt into (likely make sense for TOR publish what the impact of this is and Cloudflare to link to it in from that page) and always let users know a global session is set in case the user believe that using TOR they reset the session Has this been researched or suggested by the Tor project at all? I think it's fairly dangerous to suggest CloudFlare starts offering something like this before it has been vetted.
creshal 11y ago
> The way I justify this to myself is that the site only accepts payment via PayPal and/or credit cards, and paying with those in itself gives up a good amount of privacy. Prepaid credit cards are essentially anonymous, as far as I know.
- mootothemax 11y ago
  >Prepaid credit cards are essentially anonymous, as far as I know. My understanding is that you can only buy prepaid cards after showing ID in many jurisdictions, and many other places require you to register them with ID in order to use the cards.
  - dangrossman 11y ago
    What jurisdictions are those? You don't need ID to purchase or register Visa, MasterCard or American Express prepaid/gift cards in the US. I've bought all of those with cash, and registered them all with nothing more than the card number and CVV code.
    - middleclick 11y ago
      In Canada, the prepaid cards I got once required me to submit a government ID. These are the ones from Canada Post in case anyone is curious.
      - jat850 11y ago
        I have never bought them from Canada Post, but I have bought them countless other times in Canada and never showed ID for any of them. However, in order to make certain purchases online, it's often been the case that you need to "Register" the card with the provider, and supply details that would match billing information for the selling party. I can't see any reason why you couldn't fudge that, although shipping information for real goods would leak information.
  - wil421 11y ago
    I am not aware of any places that ID for purchasing prepaid cards, let alone prepaid burner phones. One of the way scammers get "cash" is to buy Amex gift cards with stolen credit cards. Then use those Amex gift cards to buy more amex gift cards until they feel confident the trail is murky enough. Or they use a combination of store gift cards to buy Amex/Visa gift cards.
nothrabannosir 11y ago
This is where 3D Secure truly shines; instead of completely refusing a transaction, you can request the issuing bank (= bank of the card used to pay with) to accept the liability in case of fraud (normally, it's the merchant who has to give the money back). Usually the issuing bank will then request the customer for additional challenge, e.g. a 2FA token, a code in SMS, or just their birthday. Some don't even require anything. To you as a merchant, though, that doesn't matter: if the person who bought your product was a fraudster, the money is still yours. Now it's the issuing bank on the hook for fraud, instead of the merchant. The argument against 3DS is it kills conversion rates (meaning: lots of legitimate customers don't complete that extra challenge, who would otherwise have made the purchase). But for legitimate customers using TOR, I wouldn't be surprised if that number were very different :) I know I wouldn't mind whipping out a 2fa device every time I purchased something over TOR. I mean, fair play, right? 3DS is available today in Europe, Asia and Africa! :'( but not ubiquitously in the USA. Yet. It's getting there. More info: https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure
- edwintorok 11y ago
  Why is the choice of using 3DSecure up to the merchant? If 3Dsecure is enabled it shouldn't be possible to make an online purchase without going through 3D secure. Or is this just for cards that don't have 3D secure enabled yet? For example I have 3D secure enabled, and all my online purchases (in my own country) always require to type in the password on the bank's gateway site. If I see a site that allows me to make a purchase without going through 3Dsecure I'd be worried and probably call my bank.
  - nothrabannosir 11y ago
    Because the liability is never with the customer in the first place. It's fine that you're worried, but, in reality, you don't really have to be; card gets stolen? See a charge you don't recognize? Not your problem! Call your bank, get your money back. The one who has to fear fraudsters is not the card owner; it's the merchant! Without 3D Secure, they have to pay the money back! + an extra fine, for good measure. And, of course, the product / service is already gone.
bluejekyll 11y ago
> I don't know what the solution is here. Should the ToR network be doing some amount of self policing? (Can it?) I know this might be against some of its principles, but it seems that ToR is there to create privacy, not to be used for criminal activity. And yes, criminal activity differs based on jurisdiction, but I think fraud is generally something everyone agrees should not be allowed.
- pfg 11y ago
  If this were possible, it would be a serious flaw in Tor's design.
j_s 11y ago
How do you classify traffic as from the Tor network? I am interested in how this is done for a real e-commerce site in production.
- dsmithatx 11y ago
  We get a list of Tor exit nodes and regex our logs. We were under attack from Tor for about 6 weeks. We didn't block Tor as we are pro-Tor/privacy etc. The attacker was basically running very crappy pen testing kiddie script stuff against us. We just logged everything and enjoyed the free Pen test.
- chatmasta 11y ago
  The list of Tor exit nodes is public and updated live. https://check.torproject.org/exit-addresses https://check.torproject.org/exit-addresses
amazon_not 11y ago
You could offer Tor users only the option to pay with Bitcoin. No chargebacks and less loss of privacy.

jimktrains2 11y ago

Tor can't possibly be the only signal of fraudulent activity though? It may be one that has an easy "solution" however, but one that's easily circumvented (one of the many free VPN services out there).

mootothemax 11y ago
>Tor can't possibly be the only signal of fraudulent activity though? Yes and no. Yes: many fraudsters are ridiculously lazy, and fraud rates go down when the tor block is in place. No: plenty of fraudsters access from elsewhere (and I put them through a separate fraud-detection-SaaS)
nxzero 11y ago
Signal according to Cloudflare isn't "TOR" but the IP's the are used by TOR exit nodes get banned due to them being shared and abused enough to trigger that IP being tagged as a source of trouble. I personally don't buy this, since I know of IPs they don't block again would get enough abussive traffic to merit the same treatment, but don't get the treatment TOR's IPs get.
- Kalium 11y ago
  Since you think CloudFlare is lying, what do you think the truth is?
  - nxzero 11y ago
    Not sure, though given enough dialog on the topic, I believe that a better solution will be found or it'll become clear that Cloudflare is not responding to the issue. Simple answer would be that the original analysis is flawed, they've forgotten that the wrote a script to block TOR exit IPs; TOR intentionally provides a list of these IPs to the public. Might be worth noting that TOR users are often the target of National Security Letters, that Cloudflare based on their own report received National Security Letters, and as such, would be unable to say if those letters impacted code on the topic.
    - Kalium 11y ago
      What kind of "better solution" do you envision? Right now you seem to be insisting that there must be one, which I must say does not make a very compelling case that one actually exists or is possible.
      - nxzero 11y ago
        Given Cloudflare appears to have received National Security Letters, it's possible their is no answers. That said, based on what I know, the answer is to whitelist the TOR IPs, give TOR users a global session that the user has the option to opt into (likely make sense for TOR publish what the impact of this is and Cloudflare to link to it in from that page) and always let users know a global session is set in case the user believe that using TOR they reset the session; resetting it via Cloudflare would be meaningless. General gist though is humans are not bots, don't behave as bots, and Cloudflare treats ever request as the same from an IP, which is a poor way to block bots.
        pfg 11y ago
        > That said, based on what I know, the answer is to whitelist the TOR IPs That's an option CloudFlare is offering to their customers now. > give TOR users a global session that the user has the option to opt into (likely make sense for TOR publish what the impact of this is and Cloudflare to link to it in from that page) and always let users know a global session is set in case the user believe that using TOR they reset the session Has this been researched or suggested by the Tor project at all? I think it's fairly dangerous to suggest CloudFlare starts offering something like this before it has been vetted.

creshal 11y ago

> The way I justify this to myself is that the site only accepts payment via PayPal and/or credit cards, and paying with those in itself gives up a good amount of privacy. Prepaid credit cards are essentially anonymous, as far as I know.

mootothemax 11y ago
>Prepaid credit cards are essentially anonymous, as far as I know. My understanding is that you can only buy prepaid cards after showing ID in many jurisdictions, and many other places require you to register them with ID in order to use the cards.
- dangrossman 11y ago
  What jurisdictions are those? You don't need ID to purchase or register Visa, MasterCard or American Express prepaid/gift cards in the US. I've bought all of those with cash, and registered them all with nothing more than the card number and CVV code.
  - middleclick 11y ago
    In Canada, the prepaid cards I got once required me to submit a government ID. These are the ones from Canada Post in case anyone is curious.
    - jat850 11y ago
      I have never bought them from Canada Post, but I have bought them countless other times in Canada and never showed ID for any of them. However, in order to make certain purchases online, it's often been the case that you need to "Register" the card with the provider, and supply details that would match billing information for the selling party. I can't see any reason why you couldn't fudge that, although shipping information for real goods would leak information.
- wil421 11y ago
  I am not aware of any places that ID for purchasing prepaid cards, let alone prepaid burner phones. One of the way scammers get "cash" is to buy Amex gift cards with stolen credit cards. Then use those Amex gift cards to buy more amex gift cards until they feel confident the trail is murky enough. Or they use a combination of store gift cards to buy Amex/Visa gift cards.

nothrabannosir 11y ago

This is where 3D Secure truly shines; instead of completely refusing a transaction, you can request the issuing bank (= bank of the card used to pay with) to accept the liability in case of fraud (normally, it's the merchant who has to give the money back). Usually the issuing bank will then request the customer for additional challenge, e.g. a 2FA token, a code in SMS, or just their birthday. Some don't even require anything. To you as a merchant, though, that doesn't matter: if the person who bought your product was a fraudster, the money is still yours. Now it's the issuing bank on the hook for fraud, instead of the merchant. The argument against 3DS is it kills conversion rates (meaning: lots of legitimate customers don't complete that extra challenge, who would otherwise have made the purchase). But for legitimate customers using TOR, I wouldn't be surprised if that number were very different :) I know I wouldn't mind whipping out a 2fa device every time I purchased something over TOR. I mean, fair play, right? 3DS is available today in Europe, Asia and Africa! :'( but not ubiquitously in the USA. Yet. It's getting there. More info: https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure

edwintorok 11y ago
Why is the choice of using 3DSecure up to the merchant? If 3Dsecure is enabled it shouldn't be possible to make an online purchase without going through 3D secure. Or is this just for cards that don't have 3D secure enabled yet? For example I have 3D secure enabled, and all my online purchases (in my own country) always require to type in the password on the bank's gateway site. If I see a site that allows me to make a purchase without going through 3Dsecure I'd be worried and probably call my bank.
- nothrabannosir 11y ago
  Because the liability is never with the customer in the first place. It's fine that you're worried, but, in reality, you don't really have to be; card gets stolen? See a charge you don't recognize? Not your problem! Call your bank, get your money back. The one who has to fear fraudsters is not the card owner; it's the merchant! Without 3D Secure, they have to pay the money back! + an extra fine, for good measure. And, of course, the product / service is already gone.

bluejekyll 11y ago

> I don't know what the solution is here. Should the ToR network be doing some amount of self policing? (Can it?) I know this might be against some of its principles, but it seems that ToR is there to create privacy, not to be used for criminal activity. And yes, criminal activity differs based on jurisdiction, but I think fraud is generally something everyone agrees should not be allowed.

pfg 11y ago
If this were possible, it would be a serious flaw in Tor's design.

j_s 11y ago

How do you classify traffic as from the Tor network? I am interested in how this is done for a real e-commerce site in production.

dsmithatx 11y ago
We get a list of Tor exit nodes and regex our logs. We were under attack from Tor for about 6 weeks. We didn't block Tor as we are pro-Tor/privacy etc. The attacker was basically running very crappy pen testing kiddie script stuff against us. We just logged everything and enjoyed the free Pen test.
chatmasta 11y ago
The list of Tor exit nodes is public and updated live. https://check.torproject.org/exit-addresses https://check.torproject.org/exit-addresses

amazon_not 11y ago

You could offer Tor users only the option to pay with Bitcoin. No chargebacks and less loss of privacy.