6 ms·

Hi, I'm completely sympathetic to your problem - Tor is used by lots of spammers - totally understandable to try to prevent this spam from hitting your custome

Hi, I'm completely sympathetic to your problem - Tor is used by lots of spammers - totally understandable to try to prevent this spam from hitting your customers. But most of the services I run can't really be affected by this sort of spam (no public comment systems for example). I use CloudFlare on a few of my domains, if I don't care about bot traffic and just want to turn this CAPTCHA system off entirely, is there a way with just a pro account to do so? I appreciate the anti-DDoS protection and certainly having it automatically kick these CAPTCHAs on with only extremely high volumes of traffic could be appropriate, but enforcing them is just too much. I have security level set to minimum, but recently spun up a hidden service because users were still getting CAPTCHA'd over Tor.

kristofferR 11y ago
Yeah, I don't get why CloudFlare are so overaggressive with the captchas. The vast majority of captcha'd pages by CloudFlare on Tor which makes secure web browsing so cumbersome are completely read-only, while some may have a comment system hosted by a third party like Disqus and Facebook (and are therefore protected already). Other sites should have the captchas on a different level than the front page, like the login forms and other pages where write/spam access is somehow enabled. I can think of very few sites that are in need of a total ban on anonymous users/bots or that are write-access enabled by default without any login process.
- grey-area 11y ago
  They also protect against ddos, sqli, overuse, bots etc. so comment spam is only one problem and get requests are not always safe. You'd think they could be far more sophisticated about reputation though and adjust it in realtime so that ips are by default trusted and are marked down temporarily for bad behaviour.
  - ascorbic 11y ago
    The problem is that with Tor the IP isn't much use as an identifier to establish reputation. As CloudFlare say in their post, they do use reputation of the exit node IPs to some extent, but the trouble is that there's so much abuse from Tor, most exit nodes always have bad rep. The zero knowledge tokens t hat they talk about are a way of establishing reputation without losing anonymity.
    - grey-area 11y ago
      What they do at present appears to be to assign long term reputation to tor nodes, but if instead they assigned reputation over a few minutes and reset it soon after, wouldn't that work better and avoid being overly broad? More load for them obviously but could possibly be done just for tor nodes. The token scheme looks interesting though as long as it was truly anonymous and tokens were different on each request to avoid tracking. https://github.com/gtank/captcha-draft/blob/master/captcha-plugin-draft.txt https://github.com/gtank/captcha-draft/blob/master/captcha-p... i wonder if they could do a plugin for the tor browser so that they don't have to wait for tor?
  - avip 11y ago
    Other CDN/WAF providers are indeed doing that.
  - CloudFlrFeedbck 11y ago
    When are GET requests unsafe?
    - grey-area 11y ago
      ddos or sqli, see the cf article
      - CloudFlrFeedbck 11y ago
        A respectable CDN should be able to handle lots of GET requests, even if by attack. As others have pointed out, the Tor network can't support much traffic, so DDoS by GET requests does not seem like a big concern.
- avip 11y ago
  "Read-only" pages are still fertile ground for layer 7 DDOS.
  - kristofferR 11y ago
    It wouldn't be hard to only display the captchas if sudden increased traffic from Tor exits indicated that a DDOS through Tor was in action.
    - ultramancool 11y ago
      Not only that but you could only display CAPTCHAs on the actual target of the DDoS.
  - throwaway-10439 11y ago
    The Tor egress bandwidth is sufficiently small and sparsely located that this wouldn't be an issue for a CDN.
    - seabee 11y ago
      It remains an issue for the origin server if the DDoS targets uncacheable content.
eastdakota 11y ago
Yes, you can whitelist Tor. This is available at no cost for all customers regardless of plan level: https://support.cloudflare.com/hc/en-us/articles/203306930-Does-CloudFlare-block-Tor- https://support.cloudflare.com/hc/en-us/articles/203306930-D...
- ultramancool 11y ago
  Thanks. Can I whitelist the whole internet (by using /0 perhaps?) using this method? I've seen people complaining about this issue on VPNs and such too.
  - JakeTheAndroid 11y ago
    You can whitelist CIDR ranges of /16 and /24 currently. So yes, you can to some extent whitelist everyone.
    - ultramancool 11y ago
      If I can only to /16s at the largest, I would have to add on the order 65k ranges to accomplish it... not exactly desirable way to spend an afternoon. Even via API I don't think they'd be too happy with me.
      - JakeTheAndroid 11y ago
        I agree, this is not the most efficient way to whitelist everyone, but my point was to outline you can whitelist whoever you want. Hopefully support for wider ranges will be added.
    - revelation 11y ago
      Yes, just add 65536 exceptions!
      - vacri 11y ago
        No need to add 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, and a few others...

kristofferR 11y ago

Yeah, I don't get why CloudFlare are so overaggressive with the captchas. The vast majority of captcha'd pages by CloudFlare on Tor which makes secure web browsing so cumbersome are completely read-only, while some may have a comment system hosted by a third party like Disqus and Facebook (and are therefore protected already). Other sites should have the captchas on a different level than the front page, like the login forms and other pages where write/spam access is somehow enabled. I can think of very few sites that are in need of a total ban on anonymous users/bots or that are write-access enabled by default without any login process.

grey-area 11y ago
They also protect against ddos, sqli, overuse, bots etc. so comment spam is only one problem and get requests are not always safe. You'd think they could be far more sophisticated about reputation though and adjust it in realtime so that ips are by default trusted and are marked down temporarily for bad behaviour.
- ascorbic 11y ago
  The problem is that with Tor the IP isn't much use as an identifier to establish reputation. As CloudFlare say in their post, they do use reputation of the exit node IPs to some extent, but the trouble is that there's so much abuse from Tor, most exit nodes always have bad rep. The zero knowledge tokens t hat they talk about are a way of establishing reputation without losing anonymity.
  - grey-area 11y ago
    What they do at present appears to be to assign long term reputation to tor nodes, but if instead they assigned reputation over a few minutes and reset it soon after, wouldn't that work better and avoid being overly broad? More load for them obviously but could possibly be done just for tor nodes. The token scheme looks interesting though as long as it was truly anonymous and tokens were different on each request to avoid tracking. https://github.com/gtank/captcha-draft/blob/master/captcha-plugin-draft.txt https://github.com/gtank/captcha-draft/blob/master/captcha-p... i wonder if they could do a plugin for the tor browser so that they don't have to wait for tor?
- avip 11y ago
  Other CDN/WAF providers are indeed doing that.
- CloudFlrFeedbck 11y ago
  When are GET requests unsafe?
  - grey-area 11y ago
    ddos or sqli, see the cf article
    - CloudFlrFeedbck 11y ago
      A respectable CDN should be able to handle lots of GET requests, even if by attack. As others have pointed out, the Tor network can't support much traffic, so DDoS by GET requests does not seem like a big concern.
avip 11y ago
"Read-only" pages are still fertile ground for layer 7 DDOS.
- kristofferR 11y ago
  It wouldn't be hard to only display the captchas if sudden increased traffic from Tor exits indicated that a DDOS through Tor was in action.
  - ultramancool 11y ago
    Not only that but you could only display CAPTCHAs on the actual target of the DDoS.
- throwaway-10439 11y ago
  The Tor egress bandwidth is sufficiently small and sparsely located that this wouldn't be an issue for a CDN.
  - seabee 11y ago
    It remains an issue for the origin server if the DDoS targets uncacheable content.

eastdakota 11y ago

Yes, you can whitelist Tor. This is available at no cost for all customers regardless of plan level: https://support.cloudflare.com/hc/en-us/articles/203306930-Does-CloudFlare-block-Tor- https://support.cloudflare.com/hc/en-us/articles/203306930-D...

ultramancool 11y ago
Thanks. Can I whitelist the whole internet (by using /0 perhaps?) using this method? I've seen people complaining about this issue on VPNs and such too.
- JakeTheAndroid 11y ago
  You can whitelist CIDR ranges of /16 and /24 currently. So yes, you can to some extent whitelist everyone.
  - ultramancool 11y ago
    If I can only to /16s at the largest, I would have to add on the order 65k ranges to accomplish it... not exactly desirable way to spend an afternoon. Even via API I don't think they'd be too happy with me.
    - JakeTheAndroid 11y ago
      I agree, this is not the most efficient way to whitelist everyone, but my point was to outline you can whitelist whoever you want. Hopefully support for wider ranges will be added.
  - revelation 11y ago
    Yes, just add 65536 exceptions!
    - vacri 11y ago
      No need to add 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, and a few others...