3 ms·

Customers can toggle how much they want IP reputation to be taken into account on a site by site basis. Agree that it should be a customer's choice, which is wh

Customers can toggle how much they want IP reputation to be taken into account on a site by site basis. Agree that it should be a customer's choice, which is why it has been since the day we launched in 2010. The seeming disconnect is that the vast majority of our customers ask us to provide them a way to block Tor entirely. And we've resisted that because we believe the anonymity Tor provides is a good thing. Same reason we don't allow the vast majority of customers to entirely block traffic from an entire a country, even though it's one of our top customer support requests.

fweespee_ch 11y ago
> Same reason we don't allow the vast majority of customers to entirely block traffic from an entire a country, even though it's one of our top customer support requests. https://www.cloudflare.com/features-security/ https://www.cloudflare.com/features-security/ > In addition to CloudFlare’s automatic detection, you can easily add an IP address, IP ranges or entire countries to your Trust and Block list. Umm, vast majority is non-paying I take it since I believe its available on every paid plain? https://support.cloudflare.com/hc/en-us/articles/200170056-What-is-CloudFlare-s-Basic-Security-Level- https://support.cloudflare.com/hc/en-us/articles/200170056-W... > A low security setting will challenge only the most threatening visitors. A high security setting will challenge all visitors that have exhibited threatening behavior within the last 14 days. I'm guessing you mean the "Essentially Off" option which implies Cloudflare basically stops providing security?
brightball 11y ago
For what it's worth, as somebody who used to manage a site that was under constant attack and who's users were regularly victims of phishing...I appreciate blocking Tor. We weren't using Cloudflare but our own systems that were using IP threat rating services like MaxMind but eventually we had to totally prevent anything important from being done on the site via anonymous proxies. Bids, Listing Creation, Payments of any kind had to be completely blocked from those sources. People were using Tor to create fake listings on fake users with stolen credit cards that we were then paying charge back fees for. Using Tor to bid up their own auctions. Direct messages soliciting users to take the transactions off site. Blocking those systems was one of the most effective things that we had to do and our users were vocally happier about it.

fweespee_ch 11y ago

> Same reason we don't allow the vast majority of customers to entirely block traffic from an entire a country, even though it's one of our top customer support requests. https://www.cloudflare.com/features-security/ https://www.cloudflare.com/features-security/ > In addition to CloudFlare’s automatic detection, you can easily add an IP address, IP ranges or entire countries to your Trust and Block list. Umm, vast majority is non-paying I take it since I believe its available on every paid plain? https://support.cloudflare.com/hc/en-us/articles/200170056-What-is-CloudFlare-s-Basic-Security-Level- https://support.cloudflare.com/hc/en-us/articles/200170056-W... > A low security setting will challenge only the most threatening visitors. A high security setting will challenge all visitors that have exhibited threatening behavior within the last 14 days. I'm guessing you mean the "Essentially Off" option which implies Cloudflare basically stops providing security?

brightball 11y ago

For what it's worth, as somebody who used to manage a site that was under constant attack and who's users were regularly victims of phishing...I appreciate blocking Tor. We weren't using Cloudflare but our own systems that were using IP threat rating services like MaxMind but eventually we had to totally prevent anything important from being done on the site via anonymous proxies. Bids, Listing Creation, Payments of any kind had to be completely blocked from those sources. People were using Tor to create fake listings on fake users with stolen credit cards that we were then paying charge back fees for. Using Tor to bid up their own auctions. Direct messages soliciting users to take the transactions off site. Blocking those systems was one of the most effective things that we had to do and our users were vocally happier about it.