5 ms·

It has enough detail: The claim is that an adversary who can measure traffic on CloudFlare's side (i.e. you) and the users ISP (i.e. your hypothetical friend m

by yoo1I 10y ago

It has enough detail: The claim is that an adversary who can measure traffic on CloudFlare's side (i.e. you) and the users ISP (i.e. your hypothetical friend mallory) can collude by measuring and comparing the bursts of packets generated during puzzle solving on the ISP side and the receipt of said packets on CF's side. This information is enough to figure out that Alice wanted to reach example.com via TOR. This works because reCAPTCHA has a detectable data signature. But you are in the position to inject any javascript you like anyhow, so it's not really reCAPTCHA specific in a technical sense, it's just that that would be a good coverstory if Eve were to try to make you and mallory cooperate to de-anonymize Alice.

jgrahamc 10y ago
But it's a Google-served reCAPTCHA so there's nothing to measure on CloudFlare. So I disagree that there's detail here. Need real technical detail to be able to take action. If this were a paper or PoC then would be different. If there's a way to do that then please report it to us.
- yoo1I 10y ago
  You're right of course wrt to Google serving reCAPTCHA, in this case you'd just be providing plausible deniability if Google and Mallory-ISP were to collude to exploit this. Tor users on google fiber take note.
  - lucb1e 10y ago
    > users on google fiber take note. This is why I got quite scared when I first heard of Google Fiber. It's in Google's interest to provide good, fast and cheap service: they will gain more customers and more people will be able to use more Internet services (many of which are from Google or use Google -- adwords, analytics, etc.). Thus they provide speeds for prices that are very hard to compete with for normal ISPs, since normal ISPs don't have the luxury of being the world's most popular, well, so many things (search engine, mapping service, email service, ad service, etc.). If one company knows everything about you and controls a big enough stake in your life, that sounds very scary to me. Not because Google is bad, but because it's one company able to control many basic services.
jsmthrowaway 10y ago
That's all well and good except for, to my knowledge, the reCAPTCHA widget being served by Google and communicating solely with Google as 'jgrahamc points out. The amount of Cloudflare blame in this article does not mesh well with plain logic (I'm kinda disappointed with Cryptome, TBH). I believe the only thing handed to Cloudflare during and after the reCAPTCHA is solved is a token of some kind indicating Google's confidence the user is real. If I'm wrong about this I'd be surprised, because it would then be possible for server-side operators to tamper with Google's machine learning that they're doing with reCAPTCHA users. I'm almost positive these claims are completely false, for example: > Cloudflare can conveniently serve few more images to specific users > Each click on one of the images in the puzzle generates a total of about 50 packets between Tor user's computer and the Cloudflare's server (about half are requests and half are real-time responses from the server.) > The packet group has predictable sizes and patterns, so all the adversary has to do is note the easily detectable signature of the "image click" event, and correlate it with the same on the Cloudflare side. There is no API documentation in the reCAPTCHA widget about your server having to handle real-time requests from users solving the widget or serve images, so there is no Cloudflare side. It wouldn't make sense from an API perspective; why would I have to add a bunch of code to my server to handle this stuff? Google runs that. Look here: https://developers.google.com/recaptcha/docs/display https://developers.google.com/recaptcha/docs/display Do you see a "handle real time image click events" API here for Cloudflare to deploy? You do not. Google would have to build backends for their machine learning and fraud detection algorithms in every language an API user would ever run, and then they also lose obscurity by shipping them. The image click events almost certainly go only to Google, never Cloudflare, so I think whoever sent this tip didn't understand what they were looking at in Wireshark. The possible threat vector here is Google, not Cloudflare. Cloudflare just happens to have deployed Google's reCAPTCHA widely. The article is misleading and incredibly light on important detail; how about even a screenshot of a packet capture showing traffic to Cloudflare? If you want my honest take, I read this as a Tor user annoyed they have to solve reCAPTCHAs on Cloudflare sites (the "insistence" and quoted "protects" bits are the clue) and looking for something to hit them with, and a lack of diligence on Cryptome's part before posting it. https://www.gstatic.com/recaptcha/api2/r20160712125018/recaptcha__en.js https://www.gstatic.com/recaptcha/api2/r20160712125018/recap... is the current version of the widget if anybody is curious, but I haven't looked closely.

by yoo1I 10y ago

jgrahamc 10y ago

But it's a Google-served reCAPTCHA so there's nothing to measure on CloudFlare. So I disagree that there's detail here. Need real technical detail to be able to take action. If this were a paper or PoC then would be different. If there's a way to do that then please report it to us.

yoo1I 10y ago
You're right of course wrt to Google serving reCAPTCHA, in this case you'd just be providing plausible deniability if Google and Mallory-ISP were to collude to exploit this. Tor users on google fiber take note.
- lucb1e 10y ago
  > users on google fiber take note. This is why I got quite scared when I first heard of Google Fiber. It's in Google's interest to provide good, fast and cheap service: they will gain more customers and more people will be able to use more Internet services (many of which are from Google or use Google -- adwords, analytics, etc.). Thus they provide speeds for prices that are very hard to compete with for normal ISPs, since normal ISPs don't have the luxury of being the world's most popular, well, so many things (search engine, mapping service, email service, ad service, etc.). If one company knows everything about you and controls a big enough stake in your life, that sounds very scary to me. Not because Google is bad, but because it's one company able to control many basic services.

jsmthrowaway 10y ago

That's all well and good except for, to my knowledge, the reCAPTCHA widget being served by Google and communicating solely with Google as 'jgrahamc points out. The amount of Cloudflare blame in this article does not mesh well with plain logic (I'm kinda disappointed with Cryptome, TBH). I believe the only thing handed to Cloudflare during and after the reCAPTCHA is solved is a token of some kind indicating Google's confidence the user is real. If I'm wrong about this I'd be surprised, because it would then be possible for server-side operators to tamper with Google's machine learning that they're doing with reCAPTCHA users. I'm almost positive these claims are completely false, for example: > Cloudflare can conveniently serve few more images to specific users > Each click on one of the images in the puzzle generates a total of about 50 packets between Tor user's computer and the Cloudflare's server (about half are requests and half are real-time responses from the server.) > The packet group has predictable sizes and patterns, so all the adversary has to do is note the easily detectable signature of the "image click" event, and correlate it with the same on the Cloudflare side. There is no API documentation in the reCAPTCHA widget about your server having to handle real-time requests from users solving the widget or serve images, so there is no Cloudflare side. It wouldn't make sense from an API perspective; why would I have to add a bunch of code to my server to handle this stuff? Google runs that. Look here: https://developers.google.com/recaptcha/docs/display https://developers.google.com/recaptcha/docs/display Do you see a "handle real time image click events" API here for Cloudflare to deploy? You do not. Google would have to build backends for their machine learning and fraud detection algorithms in every language an API user would ever run, and then they also lose obscurity by shipping them. The image click events almost certainly go only to Google, never Cloudflare, so I think whoever sent this tip didn't understand what they were looking at in Wireshark. The possible threat vector here is Google, not Cloudflare. Cloudflare just happens to have deployed Google's reCAPTCHA widely. The article is misleading and incredibly light on important detail; how about even a screenshot of a packet capture showing traffic to Cloudflare? If you want my honest take, I read this as a Tor user annoyed they have to solve reCAPTCHAs on Cloudflare sites (the "insistence" and quoted "protects" bits are the clue) and looking for something to hit them with, and a lack of diligence on Cryptome's part before posting it. https://www.gstatic.com/recaptcha/api2/r20160712125018/recaptcha__en.js https://www.gstatic.com/recaptcha/api2/r20160712125018/recap... is the current version of the widget if anybody is curious, but I haven't looked closely.