4 ms·

This is a tough situation. I don't know about 94% of TOR traffic being fraudulent but I'm sure it's high. But I'm one of the legit users that gets taken out by

This is a tough situation. I don't know about 94% of TOR traffic being fraudulent but I'm sure it's high. But I'm one of the legit users that gets taken out by blacklisting. I use a VPN service pretty regularly and it makes accessing my Cloudflare account and sites using it incredibly annoying.

altotrees 11y ago
Yeah, 94% seems very high, and although I guess it could be possible, I can't imagine it is quite that high. Cloudflare is zeroed-in on Tor users, but am I crazy for thinking that there are several other ways bad actors could create issues not using Tor? It seems like they are trying to come up with an amicable solution, but for the moment, legitimate Tor and VPN service users suffer. If Cloudflare really refuses to acknowledge that their view may be a tad skewed, I don't see how this is readily or easily remedied.
- pfg 11y ago
  A large percentage of malicious traffic is most likely generated by bots, which are quite naturally better at creating a lot of requests.
fluidcruft 11y ago
I assume the actual claim is that 94% of fraudulent traffic comes via tor. Which is quite a different claim. There's a pretty obvious calculus. If you approach the question as 94% of the fraudulent traffic comes from the x% of total traffic that comes via tor... deciding to block tor exit nodes seems rational (particularly if x% is particularly small... say <1%).
- Kalium 11y ago
  > I assume the actual claim is that 94% of fraudulent traffic comes via tor. Which is quite a different claim. The claim is thus: > Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious. That doesn’t mean they are visiting controversial content, but instead that they are automated requests designed to harm our customers. Meaning that for any given request coming from Tor, the odds are heavily in favor of it being malicious.
blakesterz 11y ago
> I don't know about 94% of TOR traffic being fraudulent but I'm sure it's high. I was curious and ran a quick check on my servers. 5 servers, about 300 domains, checked my logs going back 1 week. I could find just ONE legitimate session. Everything else was something trying to break WordPress or PHPMyAdmin or something else. I'd love to support Tor but I feel like I can't fight this fight.
- byuu 11y ago
  While still higher than regular ISP addresses, VPN abuse should be significantly lower than Tor abuse on account of these services costing real money. And nearly all of them not accepting anonymous forms of payment. I expect my VPN use to keep me hidden amongst a crowd from various internet companies trying to track and profile me; but I don't expect for a minute that it offers protection against criminal activities (and I have no intention of engaging in such things.) Any intelligent criminal would likely feel the same way and not use a service with their real billing information to commit crimes. Especially with Tor available. Yet despite this, I am constantly hit by CloudFlare captchas on sites that are very clearly not being hit by DoS traffic. Further, it seems site operators don't even realize this is happening. When I reported the captcha issue to Zotac's Twitter account, they had no idea CloudFlare was doing this. Google is also a huge offender with the captchas. I'm this close to switching to Duck Duck Go. Facebook is too, but I'm fine with not ever going there.

altotrees 11y ago

Yeah, 94% seems very high, and although I guess it could be possible, I can't imagine it is quite that high. Cloudflare is zeroed-in on Tor users, but am I crazy for thinking that there are several other ways bad actors could create issues not using Tor? It seems like they are trying to come up with an amicable solution, but for the moment, legitimate Tor and VPN service users suffer. If Cloudflare really refuses to acknowledge that their view may be a tad skewed, I don't see how this is readily or easily remedied.

pfg 11y ago
A large percentage of malicious traffic is most likely generated by bots, which are quite naturally better at creating a lot of requests.

fluidcruft 11y ago

I assume the actual claim is that 94% of fraudulent traffic comes via tor. Which is quite a different claim. There's a pretty obvious calculus. If you approach the question as 94% of the fraudulent traffic comes from the x% of total traffic that comes via tor... deciding to block tor exit nodes seems rational (particularly if x% is particularly small... say <1%).

Kalium 11y ago
> I assume the actual claim is that 94% of fraudulent traffic comes via tor. Which is quite a different claim. The claim is thus: > Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious. That doesn’t mean they are visiting controversial content, but instead that they are automated requests designed to harm our customers. Meaning that for any given request coming from Tor, the odds are heavily in favor of it being malicious.

blakesterz 11y ago

> I don't know about 94% of TOR traffic being fraudulent but I'm sure it's high. I was curious and ran a quick check on my servers. 5 servers, about 300 domains, checked my logs going back 1 week. I could find just ONE legitimate session. Everything else was something trying to break WordPress or PHPMyAdmin or something else. I'd love to support Tor but I feel like I can't fight this fight.

byuu 11y ago
While still higher than regular ISP addresses, VPN abuse should be significantly lower than Tor abuse on account of these services costing real money. And nearly all of them not accepting anonymous forms of payment. I expect my VPN use to keep me hidden amongst a crowd from various internet companies trying to track and profile me; but I don't expect for a minute that it offers protection against criminal activities (and I have no intention of engaging in such things.) Any intelligent criminal would likely feel the same way and not use a service with their real billing information to commit crimes. Especially with Tor available. Yet despite this, I am constantly hit by CloudFlare captchas on sites that are very clearly not being hit by DoS traffic. Further, it seems site operators don't even realize this is happening. When I reported the captcha issue to Zotac's Twitter account, they had no idea CloudFlare was doing this. Google is also a huge offender with the captchas. I'm this close to switching to Duck Duck Go. Facebook is too, but I'm fine with not ever going there.