3 ms·

So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.

by deno 10y ago

corobo 10y ago
Do many malicious entities have easy access to carrier-grade NATs? Man just read up I'm essentially just summarising this anyway: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
- deno 10y ago
  Sure they do. They’re called ‘botnets.’[1] [1] https://luminati.io/ https://luminati.io/
- deleted 10y ago
  [deleted]
meowface 10y ago
Pure rough estimates, but consumer ISP subnets are probably ~1-3% malicious, while with Tor's rotating IPs, if you look over the past 5 years odds are at least 40% of exit node IPs have been associated with malicious activity at least once. It makes perfect sense to add additional verification challenges for Tor users. Also, anecdotal, but I work in infosec for a large US company and see a lot of traffic and read a lot of logs every day. The majority of all spam, fraud, and scan activity comes from Tor, or consumer-advertised VPN services, or various European VPSs. Residential ISPs (excluding Chinese and Russian ones) make up almost no part of it, relative to those others. I'm pretty sure Cloudflare's challenge criteria is sourced from real data they've generated from traffic they've seen. They aren't trying to single out Tor users.
- deno 10y ago
  > It makes perfect sense to add additional verification challenges for Tor users. I’m actually perfectly fine with that. The issue is how Cloudflare does it. They should just offer something like X-Cloudflare-Fraud-Score header or even <x-cloudflare-protected-frame /> tag (they’re already doing SSI), but instead they just nuke the hell out of everything. The way they do ‘protection’ is openly hostile to open web, or even neutral web. Whether this affects Tor disproportionately or not is a minor point.

3 ms·

So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.

by deno 10y ago

So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.

corobo 10y ago
Do many malicious entities have easy access to carrier-grade NATs? Man just read up I'm essentially just summarising this anyway: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
- deno 10y ago
  Sure they do. They’re called ‘botnets.’[1] [1] https://luminati.io/ https://luminati.io/
- deleted 10y ago
  [deleted]
meowface 10y ago
Pure rough estimates, but consumer ISP subnets are probably ~1-3% malicious, while with Tor's rotating IPs, if you look over the past 5 years odds are at least 40% of exit node IPs have been associated with malicious activity at least once. It makes perfect sense to add additional verification challenges for Tor users. Also, anecdotal, but I work in infosec for a large US company and see a lot of traffic and read a lot of logs every day. The majority of all spam, fraud, and scan activity comes from Tor, or consumer-advertised VPN services, or various European VPSs. Residential ISPs (excluding Chinese and Russian ones) make up almost no part of it, relative to those others. I'm pretty sure Cloudflare's challenge criteria is sourced from real data they've generated from traffic they've seen. They aren't trying to single out Tor users.
- deno 10y ago
  > It makes perfect sense to add additional verification challenges for Tor users. I’m actually perfectly fine with that. The issue is how Cloudflare does it. They should just offer something like X-Cloudflare-Fraud-Score header or even <x-cloudflare-protected-frame /> tag (they’re already doing SSI), but instead they just nuke the hell out of everything. The way they do ‘protection’ is openly hostile to open web, or even neutral web. Whether this affects Tor disproportionately or not is a minor point.