5 ms·
Do Cloudflare websites work from TOR then?
by gsich 9y ago
Do Cloudflare websites work from TOR then?
- ocdtrekkie 9y agoIt appears they put a lot of work into how to handle Tor without being extremely frustrating: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
- gpm 9y agoUp to the website operator. Cloudflare actually went out of their way to make it easy to whitelist Tor IPs that would generally get automatictly blacklisted for abuse.
- f2n 9y agoThey also went out of their way to automatically treat them as more questionable by default. Unless the website operator explicitly whitelists tor, tor users are given a worse experience. EDIT: Maybe not anymore? See replies
- ocdtrekkie 9y agoThis probably isn't really correct. Their blog says that 94% of the traffic they were getting over Tor was malicious, and since they probably automatically put IPs where a lot of malicious traffic comes from on the CAPTCHA list, my guess is all the Tor nodes got flagged automagically. What they went out of their way to do, was explicitly make it less painful for legitimate users to use Tor, despite the amount of malicious content they get from Tor. I'd argue for most companies, if 94% of the traffic from somewhere is malicious, the answer is "block it and be done with it", but clearly, Cloudflare actually values Tor and what it stands for enough to come up with a workaround.
- xxdesmus 9y ago"They also went out of their way to automatically treat them as more questionable by default." nope, you're spreading un-sourced/unconfirmed FUD. Provide a source, or this is just FUD. Tor IPs are treated like any other IP by default, not "more questionable by default".
- f2n 9y agoPerhaps they've changed it since last time I looked a few years ago. You're right, I can't find the tor-specific anything anymore. I ditched Cloudflare years ago and haven't checked back in a while. I rather distinctly remember a default setting that explicitly talked about how it treated Tor users. I don't see that setting anymore.
- gsich 9y agoNot up to the website operator. If Cloudflare blocks TOR or annoys them with Captchas it's Cloudflares problem.
- discussedbefore 9y agoIt may be opt-in, but website operators can choose to whitelist Tor even on the free Cloudflare tier. https://support.cloudflare.com/hc/en-us/articles/203306930-Does-Cloudflare-block-Tor- https://support.cloudflare.com/hc/en-us/articles/203306930-D... The options for Tor are: Whitelist (trust) CAPTCHA (visible challenge which the visitor must interact with to pass) JavaScript Challenge (visible challenge with less friction, testing the browser) Block (blacklist -- available only to Cloudflare Enterprise customers)
- xxdesmus 9y agonope -- as stated, up to the website owner. They can whitelist Tor if they'd like to. Entirely the website owner's decision to make.
- gsich 9y agoCloudflare is responsible for even providing such a "feature". They aren't off the hook here.
- xxdesmus 9y agoIndeed, our security service allows our customer (the website owner) the option to adequately protect their website. I'm not sure you actually made a point other than to confirm that we allow website owners to fully whitelist Tor if they'd like to.
- gsich 9y agoopt-in vs. opt-out
- 9y ago
- zackbloom 9y agoCF invest a lot of work into Privacy Pass, which is a crypto token system to allow TOR browsers to verify they're human without giving up anonymity: https://privacypass.github.io/ https://privacypass.github.io/