4 ms·

Isn't the bigger issue that Cloudflare's default 'protection' setting is too eager? A few years back back I used cloud flare on my company website in an attemp

Isn't the bigger issue that Cloudflare's default 'protection' setting is too eager? A few years back back I used cloud flare on my company website in an attempt to improve speed. When I browsed from public Wifi, Cloud flare showed challenges for static sites; this seemed pretty pointless. What kind of attack is cloudflare preventing when they block people from accesing static sites?

tux3 10y ago
Since the CAPTCHAs trigger based on IP reputation, I assume they're trying to prevent things like automated forum spam, by default for everyone. I don't know if there's a setting to avoid challenges even from shady IPs unless the site is under attack, that sounds like it could apply to a lot of websites.
- mSparks 10y ago
  While obviously useful for the poor souls that live in backwards dictatorships/monarchies like north korea and the uk. i dont personally think tor exit nodes are that great an idea. tor traffic should stay on the tor network.
  - roywiggins 10y ago
    I was under the impression allowing people to access the internet at large is explicitly part of Tor's design. If you want something more inward-facing, I2P seems to lean in that direction. I2P's comparison with Tor suggests this too: https://geti2p.net/en/comparison/tor https://geti2p.net/en/comparison/tor Tor: "Designed and optimized for exit traffic, with a large number of exit nodes" I2P: "Designed and optimized for hidden services, which are much faster than in Tor"
    - mSparks 10y ago
      yes, but my point was I think its a "bad" design. It is not part of the internet, if servers want to provide "anonymous" access they can provide a tor address. But if they don't, then accessing a standard webserver via tor is very little different than any of the other means of illegitimately accessing computers. ->web access via tor seems like a lot of effort to provide what is little more than providing "hacking" services against normal webservers. I would much rather see for example: https://thepiratebay.se.onion https://thepiratebay.se.onion where tor contacts the dns for thepiratebay.se to get the underlying onion address to use. much better all round than either going through an exit node (most of which are malicious) to thepiratebay.se or trying to remember uj3wazyk5u4hnvtk.onion or whatever it has changed to now.
- blockoperation 10y ago
  The CATPCHAs might not appear for everyone, but automated JavaScript challenges seem to be required on some sites regardless of your IP (and without JavaScript, you just get stuck in a refresh loop on the challenge page). It's a real slap in the face to have to enable JavaScript just to gain access to a site, especially if it's a site that doesn't even use JavaScript, or a site that you don't entirely trust. The funny thing is that it's entirely possible to open a bunch of these tabs in the background (e.g. search for 'site:somesitethatusescloudflare' and just middle click some results that interest you for later reading) and forget about them while they sit there refreshing over and over again, until you really do get blocked (assuming they keep track of unanswered challenges like they do for failed ones).
twblalock 10y ago
> What kind of attack is cloudflare preventing when they block people from accesing static sites? Lots of sites use Cloudflare to prevent scraping.
elmin 10y ago
How would CloudFlare know it's a static site?
- rnhmjoj 10y ago
  CloudFlare usually just serve you a cached version of the site to increase performances and reduce the bandwidth. It automatically caches CSS, images and scripts but the rules are customizable.
  - jgrahamc 10y ago
    CloudFlare usually just serve you a cached version of the site to increase performances and reduce the bandwidth. This is nonsense.
  - rnhmjoj 10y ago
    Seriously? Downvoted for stating a fact? https://support.cloudflare.com/hc/en-us/articles/202775670-How-Do-I-Tell-CloudFlare-What-to-Cache- https://support.cloudflare.com/hc/en-us/articles/202775670-H...
  - angry-hacker 10y ago
    No it does not. Resources, such as css, js, pictures, often yes. You don't get cached hackernews page because they use cf in front. As the other commenter said, it's nonsense.
jgrahamc 10y ago
What kind of attack is cloudflare preventing when they block people from accesing static sites? DoS. The Tor network has quite a bit of bandwidth (https://metrics.torproject.org/bandwidth.html https://metrics.torproject.org/bandwidth.html) and we see DoS attacks at L7 (e.g. floods of HTTP requests) that attempt to knock sites with poor bandwidth/servers offline. There are many, many other attacks that come through Tor.
- gcb0 10y ago
  > sites with poor bandwidth that point is beyond moot as we are talking exclusively about sites already fronted by CF
  - jgrahamc 10y ago
    Nope. Just because Cloudflare has a ton of bandwidth doesn't mean the origin web server does. An attacker who wants to hurt an origin server just needs to find a URI that Cloudflare doesn't cache (and that's very often /; think of any site that's dynamically generated by some CMS as an example). So, if you let traffic through to an origin without running any security it's trivial for an attacker to knock off a web server. Thus Cloudflare has to take different security measures to protect servers. And we do see L7 DoS capable of knocking origin servers down via Tor.
    - gcb0 10y ago
      no sympathy then. 1. cloud fare is a crappy cdn, and 2. if you have zero caching on a cheap server you can't expect much to begin with.
adultSwim 10y ago
This! It's absurd for people to be required to do CAPTCHAs just for read access to a page. The experience of having to repeatedly perform CAPTCHAs the whole time is a real barrier.
- jgrahamc 10y ago
  There's no such thing as "read access" when it comes to web security. People think there is but consider, for example, 1. Benign GET / repeated 1000 times per second. That's a DoS on the server 2. Shellshock. Looks like a benign GET / but nasty payload in User-Agent header 3. Simple GET but with SQLi in the URI All these are real examples. All seen through Tor (and, of course, without Tor).
- detaro 10y ago
  Unless they do fairly deep analysis of the page or force customers to configure it correctly, you don't know if the page will trigger "write access" later. And while it's easy to inject a CAPTCHA into the initial access, you can't do so easily in a later POST, especially if it is triggered by JS. Would be possible with cooperation of the site code, but I doubt many companies would be willing to go to that length.

tux3 10y ago

Since the CAPTCHAs trigger based on IP reputation, I assume they're trying to prevent things like automated forum spam, by default for everyone. I don't know if there's a setting to avoid challenges even from shady IPs unless the site is under attack, that sounds like it could apply to a lot of websites.

mSparks 10y ago
While obviously useful for the poor souls that live in backwards dictatorships/monarchies like north korea and the uk. i dont personally think tor exit nodes are that great an idea. tor traffic should stay on the tor network.
- roywiggins 10y ago
  I was under the impression allowing people to access the internet at large is explicitly part of Tor's design. If you want something more inward-facing, I2P seems to lean in that direction. I2P's comparison with Tor suggests this too: https://geti2p.net/en/comparison/tor https://geti2p.net/en/comparison/tor Tor: "Designed and optimized for exit traffic, with a large number of exit nodes" I2P: "Designed and optimized for hidden services, which are much faster than in Tor"
  - mSparks 10y ago
    yes, but my point was I think its a "bad" design. It is not part of the internet, if servers want to provide "anonymous" access they can provide a tor address. But if they don't, then accessing a standard webserver via tor is very little different than any of the other means of illegitimately accessing computers. ->web access via tor seems like a lot of effort to provide what is little more than providing "hacking" services against normal webservers. I would much rather see for example: https://thepiratebay.se.onion https://thepiratebay.se.onion where tor contacts the dns for thepiratebay.se to get the underlying onion address to use. much better all round than either going through an exit node (most of which are malicious) to thepiratebay.se or trying to remember uj3wazyk5u4hnvtk.onion or whatever it has changed to now.
blockoperation 10y ago
The CATPCHAs might not appear for everyone, but automated JavaScript challenges seem to be required on some sites regardless of your IP (and without JavaScript, you just get stuck in a refresh loop on the challenge page). It's a real slap in the face to have to enable JavaScript just to gain access to a site, especially if it's a site that doesn't even use JavaScript, or a site that you don't entirely trust. The funny thing is that it's entirely possible to open a bunch of these tabs in the background (e.g. search for 'site:somesitethatusescloudflare' and just middle click some results that interest you for later reading) and forget about them while they sit there refreshing over and over again, until you really do get blocked (assuming they keep track of unanswered challenges like they do for failed ones).

twblalock 10y ago

> What kind of attack is cloudflare preventing when they block people from accesing static sites? Lots of sites use Cloudflare to prevent scraping.

elmin 10y ago

How would CloudFlare know it's a static site?

rnhmjoj 10y ago
CloudFlare usually just serve you a cached version of the site to increase performances and reduce the bandwidth. It automatically caches CSS, images and scripts but the rules are customizable.
- jgrahamc 10y ago
  CloudFlare usually just serve you a cached version of the site to increase performances and reduce the bandwidth. This is nonsense.
- rnhmjoj 10y ago
  Seriously? Downvoted for stating a fact? https://support.cloudflare.com/hc/en-us/articles/202775670-How-Do-I-Tell-CloudFlare-What-to-Cache- https://support.cloudflare.com/hc/en-us/articles/202775670-H...
- angry-hacker 10y ago
  No it does not. Resources, such as css, js, pictures, often yes. You don't get cached hackernews page because they use cf in front. As the other commenter said, it's nonsense.

jgrahamc 10y ago

What kind of attack is cloudflare preventing when they block people from accesing static sites? DoS. The Tor network has quite a bit of bandwidth (https://metrics.torproject.org/bandwidth.html https://metrics.torproject.org/bandwidth.html) and we see DoS attacks at L7 (e.g. floods of HTTP requests) that attempt to knock sites with poor bandwidth/servers offline. There are many, many other attacks that come through Tor.

gcb0 10y ago
> sites with poor bandwidth that point is beyond moot as we are talking exclusively about sites already fronted by CF
- jgrahamc 10y ago
  Nope. Just because Cloudflare has a ton of bandwidth doesn't mean the origin web server does. An attacker who wants to hurt an origin server just needs to find a URI that Cloudflare doesn't cache (and that's very often /; think of any site that's dynamically generated by some CMS as an example). So, if you let traffic through to an origin without running any security it's trivial for an attacker to knock off a web server. Thus Cloudflare has to take different security measures to protect servers. And we do see L7 DoS capable of knocking origin servers down via Tor.
  - gcb0 10y ago
    no sympathy then. 1. cloud fare is a crappy cdn, and 2. if you have zero caching on a cheap server you can't expect much to begin with.

adultSwim 10y ago

This! It's absurd for people to be required to do CAPTCHAs just for read access to a page. The experience of having to repeatedly perform CAPTCHAs the whole time is a real barrier.

jgrahamc 10y ago
There's no such thing as "read access" when it comes to web security. People think there is but consider, for example, 1. Benign GET / repeated 1000 times per second. That's a DoS on the server 2. Shellshock. Looks like a benign GET / but nasty payload in User-Agent header 3. Simple GET but with SQLi in the URI All these are real examples. All seen through Tor (and, of course, without Tor).
detaro 10y ago
Unless they do fairly deep analysis of the page or force customers to configure it correctly, you don't know if the page will trigger "write access" later. And while it's easy to inject a CAPTCHA into the initial access, you can't do so easily in a later POST, especially if it is triggered by JS. Would be possible with cooperation of the site code, but I doubt many companies would be willing to go to that length.