4 ms·

That's just flawed reasoning all around. I can't even find any e-commerce-specific data in their sources. > A report by CloudFlare competitor Akamai found that

That's just flawed reasoning all around. I can't even find any e-commerce-specific data in their sources. > A report by CloudFlare competitor Akamai found that the percentage of legitimate e-commerce traffic originating from Tor IP addresses is nearly identical to that originating from the Internet at large. (Specifically, Akamai found that the "conversion rate" of Tor IP addresses clicking on ads and performing commercial activity was "virtually equal" to that of non-Tor IP addresses). Actual data from the report: • Comparison of Tor and non-Tor Traffic: Of legitimate requests, non-Tor IPs accounted for 99.96 percent of requests, while Tor exit nodes accounted for 0.04 percent Of malicious requests, non-Tor IPs accounted for 98.74 percent of requests, while Tor exit nodes accounted for 1.26 percent • Tor exit nodes were far more likely to contain malicious requests: 1:11,500 non-Tor IPs contained malicious requests 1:380 Tor exit nodes contained malicious requests • However, traffic from Tor exit nodes yielded a conversion rate virtually equal to non-Tor IPs: Conversion rate for non-Tor IPs was 1:834 Conversion rate for Tor exit nodes was 1:895 Source: slide 7 of the report they link in the article – https://i.imgur.com/TcstnWD.jpg https://i.imgur.com/TcstnWD.jpg

deleted 11y ago
[deleted]
kordless 11y ago
> That's just flawed reasoning all around. Starting with a blanket blaming statement isn't that great either. Conversion rates and e-commerce sorta go together, so I would say it's fine to entangle them logically. Tor exit nodes entangle users with each other through an IP. If someone's lens is limited, they'll run the risk of blanket blaming the legitimate traffic as well.
ynniv 11y ago
[IP addresses of] Tor exit nodes were far more likely to contain malicious requests However, traffic from Tor exit nodes yielded a conversion rate virtually equal to non-Tor IPs You just described every busy IP address: if you handle more requests, you are more likely to handle a malicious one. This is the problem with IP based reputation.
- legutierr 11y ago
  Yes, I think that the more revealing ratio would have been total malicious requests to all requests for each class of IP. If each Tor exit node is sending out 30x as much traffic, with an average of 30 unique users per IP, then the cited ratios are meaningless. The only thing that can be drawn from that data is that Tor makes IP-based reputation tools ineffective. The thing is, for many people that may be enough to justify what Cloudflare is doing.
  - pfg 11y ago
    That's what CloudFlare did in their blog post: > Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious.
    - legutierr 11y ago
      That number does not fit with the 1:380 ratio of Tor IPs that emitted malicious requests, though. That is, unless the vast majority of all Tor traffic is routed out of only a couple of exit nodes, which does not seem consistent with the way that Tor works. How can Cloudflare assert that 94% of all requests over Tor are malicious, when Akamai seems to be saying that less than 1% of Tor IPs contain malicious requests?
adrusi 11y ago
> Tor exit nodes were far more likely to contain malicious requests That's comparing apples to oranges though. A lot of different people send requests from tor exit nodes. That might be comparable to some corporate networks, but many IP addresses are used by only one person (or a family). Intuition would suggest that tor traffic is more likely to be malicious than average traffic, but suppose there are 500 tor exit nodes in the world, and 1 malicious tor user: then 1 in 500 tor-exit node IPs would have sent a malicious request!

deleted 11y ago

[deleted]

kordless 11y ago

> That's just flawed reasoning all around. Starting with a blanket blaming statement isn't that great either. Conversion rates and e-commerce sorta go together, so I would say it's fine to entangle them logically. Tor exit nodes entangle users with each other through an IP. If someone's lens is limited, they'll run the risk of blanket blaming the legitimate traffic as well.

ynniv 11y ago

[IP addresses of] Tor exit nodes were far more likely to contain malicious requests However, traffic from Tor exit nodes yielded a conversion rate virtually equal to non-Tor IPs You just described every busy IP address: if you handle more requests, you are more likely to handle a malicious one. This is the problem with IP based reputation.

legutierr 11y ago
Yes, I think that the more revealing ratio would have been total malicious requests to all requests for each class of IP. If each Tor exit node is sending out 30x as much traffic, with an average of 30 unique users per IP, then the cited ratios are meaningless. The only thing that can be drawn from that data is that Tor makes IP-based reputation tools ineffective. The thing is, for many people that may be enough to justify what Cloudflare is doing.
- pfg 11y ago
  That's what CloudFlare did in their blog post: > Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious.
  - legutierr 11y ago
    That number does not fit with the 1:380 ratio of Tor IPs that emitted malicious requests, though. That is, unless the vast majority of all Tor traffic is routed out of only a couple of exit nodes, which does not seem consistent with the way that Tor works. How can Cloudflare assert that 94% of all requests over Tor are malicious, when Akamai seems to be saying that less than 1% of Tor IPs contain malicious requests?

adrusi 11y ago

> Tor exit nodes were far more likely to contain malicious requests That's comparing apples to oranges though. A lot of different people send requests from tor exit nodes. That might be comparable to some corporate networks, but many IP addresses are used by only one person (or a family). Intuition would suggest that tor traffic is more likely to be malicious than average traffic, but suppose there are 500 tor exit nodes in the world, and 1 malicious tor user: then 1 in 500 tor-exit node IPs would have sent a malicious request!