6 ms·

Yeah, I don't get why CloudFlare are so overaggressive with the captchas. The vast majority of captcha'd pages by CloudFlare on Tor which makes secure web brow

Yeah, I don't get why CloudFlare are so overaggressive with the captchas. The vast majority of captcha'd pages by CloudFlare on Tor which makes secure web browsing so cumbersome are completely read-only, while some may have a comment system hosted by a third party like Disqus and Facebook (and are therefore protected already). Other sites should have the captchas on a different level than the front page, like the login forms and other pages where write/spam access is somehow enabled. I can think of very few sites that are in need of a total ban on anonymous users/bots or that are write-access enabled by default without any login process.

grey-area 11y ago
They also protect against ddos, sqli, overuse, bots etc. so comment spam is only one problem and get requests are not always safe. You'd think they could be far more sophisticated about reputation though and adjust it in realtime so that ips are by default trusted and are marked down temporarily for bad behaviour.
- ascorbic 11y ago
  The problem is that with Tor the IP isn't much use as an identifier to establish reputation. As CloudFlare say in their post, they do use reputation of the exit node IPs to some extent, but the trouble is that there's so much abuse from Tor, most exit nodes always have bad rep. The zero knowledge tokens t hat they talk about are a way of establishing reputation without losing anonymity.
  - grey-area 11y ago
    What they do at present appears to be to assign long term reputation to tor nodes, but if instead they assigned reputation over a few minutes and reset it soon after, wouldn't that work better and avoid being overly broad? More load for them obviously but could possibly be done just for tor nodes. The token scheme looks interesting though as long as it was truly anonymous and tokens were different on each request to avoid tracking. https://github.com/gtank/captcha-draft/blob/master/captcha-plugin-draft.txt https://github.com/gtank/captcha-draft/blob/master/captcha-p... i wonder if they could do a plugin for the tor browser so that they don't have to wait for tor?
- avip 11y ago
  Other CDN/WAF providers are indeed doing that.
- CloudFlrFeedbck 11y ago
  When are GET requests unsafe?
  - grey-area 11y ago
    ddos or sqli, see the cf article
    - CloudFlrFeedbck 11y ago
      A respectable CDN should be able to handle lots of GET requests, even if by attack. As others have pointed out, the Tor network can't support much traffic, so DDoS by GET requests does not seem like a big concern.
avip 11y ago
"Read-only" pages are still fertile ground for layer 7 DDOS.
- kristofferR 11y ago
  It wouldn't be hard to only display the captchas if sudden increased traffic from Tor exits indicated that a DDOS through Tor was in action.
  - ultramancool 11y ago
    Not only that but you could only display CAPTCHAs on the actual target of the DDoS.
- throwaway-10439 11y ago
  The Tor egress bandwidth is sufficiently small and sparsely located that this wouldn't be an issue for a CDN.
  - seabee 11y ago
    It remains an issue for the origin server if the DDoS targets uncacheable content.

grey-area 11y ago

They also protect against ddos, sqli, overuse, bots etc. so comment spam is only one problem and get requests are not always safe. You'd think they could be far more sophisticated about reputation though and adjust it in realtime so that ips are by default trusted and are marked down temporarily for bad behaviour.

ascorbic 11y ago
The problem is that with Tor the IP isn't much use as an identifier to establish reputation. As CloudFlare say in their post, they do use reputation of the exit node IPs to some extent, but the trouble is that there's so much abuse from Tor, most exit nodes always have bad rep. The zero knowledge tokens t hat they talk about are a way of establishing reputation without losing anonymity.
- grey-area 11y ago
  What they do at present appears to be to assign long term reputation to tor nodes, but if instead they assigned reputation over a few minutes and reset it soon after, wouldn't that work better and avoid being overly broad? More load for them obviously but could possibly be done just for tor nodes. The token scheme looks interesting though as long as it was truly anonymous and tokens were different on each request to avoid tracking. https://github.com/gtank/captcha-draft/blob/master/captcha-plugin-draft.txt https://github.com/gtank/captcha-draft/blob/master/captcha-p... i wonder if they could do a plugin for the tor browser so that they don't have to wait for tor?
avip 11y ago
Other CDN/WAF providers are indeed doing that.
CloudFlrFeedbck 11y ago
When are GET requests unsafe?
- grey-area 11y ago
  ddos or sqli, see the cf article
  - CloudFlrFeedbck 11y ago
    A respectable CDN should be able to handle lots of GET requests, even if by attack. As others have pointed out, the Tor network can't support much traffic, so DDoS by GET requests does not seem like a big concern.

avip 11y ago

"Read-only" pages are still fertile ground for layer 7 DDOS.

kristofferR 11y ago
It wouldn't be hard to only display the captchas if sudden increased traffic from Tor exits indicated that a DDOS through Tor was in action.
- ultramancool 11y ago
  Not only that but you could only display CAPTCHAs on the actual target of the DDoS.
throwaway-10439 11y ago
The Tor egress bandwidth is sufficiently small and sparsely located that this wouldn't be an issue for a CDN.
- seabee 11y ago
  It remains an issue for the origin server if the DDoS targets uncacheable content.