9 ms·
I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the tr
by ShakataGaNai 8y ago
I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate".
A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a blog entry? Don't need to test. Writing a comment? CAPTCHA them to the break of dawn.
- snug 8y agoYou can do that with pagreules
- deleted 8y ago[deleted]
- philip1209 8y agoIt would be cool if you could set a header to Cloudflare when a user is logged in, perhaps with that user's ID. That could then trigger significantly decreased security.
- buro9 8y agoA kind of "if cookie exists in this format that indicates session then..." ? That is interesting.
- homero 8y agoTheir workers feature can do all kinds of things like this
- user5994461 8y agoCloudflare already does that automatically.
- deleted 8y ago[deleted]
- Reedx 8y agoWhat I do is simply check if CF-IPCountry header == "T1" and block those from being able to register accounts. T1 is Tor.
- Twisol 8y agoSource and more info: https://support.cloudflare.com/hc/en-us/articles/200168236-What-does-CloudFlare-IP-Geolocation-do- https://support.cloudflare.com/hc/en-us/articles/200168236-W...
- user5994461 8y agoDo the same on the login page. You have to stop the bots from trying to brute force user accounts and passwords.
- the8472 8y ago> You have to stop the bots from trying to brute force user accounts and passwords. That shouldn't be an issue if the passwords have enough entropy.
- user5994461 8y ago>>> if the passwords have enough entropy. Allow me to optimize your statement. >>> if False
- anticensor 8y agoWhat does it mean? Users always pick low-entropy passwords?
- judge2020 8y agoAlmost always. It's gotten better with the rise of password managers that generate random passwords, but otherwise, passwords are usually shared across many websites and usually less than 16 characters.
- dmitrygr 8y agoActually probably not very much traffic is from tor. Tor bandwidth is notoriously bad.
- fosco 8y agoare there any researched measurements to show exactly how much is available? obviously it would vary greatly depending on where the connection is going... but wondering if there is some overarching idea of what it has..
- niij 8y agohttps://metrics.torproject.org/bandwidth.html https://metrics.torproject.org/bandwidth.html Currently the network is processing ~125Gbit/s of traffic.
- fosco 8y agois there a way to see the average bandwidth a tor end user would get? seems like a good amount?
- niij 8y agoI assume you mean exit traffic. Exit traffic is anything connecting to the open internet, whereas hidden services never leaves the Tor network. For exit traffic I don't believe there is a metric for average user speed. But, I just ran a 3 speed tests using different circuits and was getting 500-800KB/s download speeds on average.
- dmitrygr 8y agoTry using it. Very slow. No matter where you are. I understand that some people have no choice other than to use it. so I stopped using it to leave whatever bandwidth there is in the exit nodes to them
- crankylinuxuser 8y ago
- zzzcpan 8y agoAs a website operator too I don't see spammers, attackers and script kiddies from tor network with valid user agents (tor browser or mainstream up to date browsers). The worst I see in that traffic is very few people trying to post/upload something anonymously, but mostly it's just people trying to access a few pages anonymously. Bots and scrappers for some reason use fake user agents in tor network and just get 403s, but the amount of that is so tiny compared to the rest of the bots, that's it's not even worth mentioning. Tor network is sort of self-limiting in this regard, because it's too slow and too obvious for such use, it's only viable for casual browsing. Cloudflare proved that it's both unwilling and unable to solve the problem.
- jrochkind1 8y agoIf I _wanted_ to use a bot on your site, despite the captcha trying to prevent it... and you exempted tor users from the captcha... why _wouldn't_ I use tor to get around it?
- GordonS 8y agoI'm not sure when you last tried Tor, but it's not that slow these days. I first tried Tor several years ago, and it was so slow I couldn't understand how anyone could bear to use it - but I tried it again recently, and (to my surprise) for general browsing at least, it didn't seem to add any noticeable lag. I wonder if Tor has finally reached critical mass and is ready for more widespread use?
- AckSyn 8y agoI'd like to not have to fill out a dozen captchas just to comment on something.
- samstave 8y agoThe following are questions based on the fact that I am ignorant of Cloudflares services/capabilities: Are you using Cloudflare purely as a CDN? Can you choose to filter access to your content from geographic regions (i.e. block all IPs from [country]) What key services/offerings are you benefiting most from using Cloudflare?
- judge2020 8y ago1. You can use it purely as a CDN, turning security to "essentially off" and only having to deal with the website certificate being sni.cloudflaressl.com 2. Only on the enterprise plan. On Pro/Business you can only "challenge" (captcha) or JS/browser Challenge countries, not outright block them. 3. Even with all the other cool and useful features, DDOS mitigation is still one of the most valuable offerings possible.
- ocdtrekkie 8y agoThe answer to your first question according to Cloudflare is 94% of Tor traffic is malicious, circa 2016: https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
- sandworm101 8y ago94% of all traffic on the internet is malicious. It all depends on your definitions. A legitimate, human, user makes a handful of connections per minute. Someone running a scanner attempts thousands per second. So if we measure attempted connections then Tor and everything is horrible. But that true for actual bandwidth. The old question: is a simple ping considered an attack? I still here people talking of how their websites are attacked thousands of times every day. Pings and other simple scans are not what I would call actual attacks.
- reitanqild 8y agoHmmm, this sounds really interesting! Do we have any sources regarding how that 94% number was calculated or are you guessing?
- sandworm101 8y agoRun a firewall on a server. Count every ping/scan as an attempted hack. Say you have 1000 legitimate users in a give day. You will probably see 1000 pings, scans, and other general junk per hour. (This is hard to do in places like cloudflare that filter much of this junk traffic before it hits their customers.)
- reitanqild 8y agoSo far I'm with you and I think I might agree with your conclusion. What I wanted to know was some background on the 94% figure, do we now this is how they arrived at that number?
- gammateam 8y agomeanwhile i2p users just fly under the radar
- stcredzero 8y agoIt's not just Tor. This also affects VPN users. It has affected me. I wouldn't call my use of a VPN for privacy as "illegitimate."
- dcposch 8y agoIt's not about whether your personal use of VPN is legitimate. It's a numbers game. For any successful site that deals in user generated content, moderation is hard and relentless work. If they observe that a high fraction of visitors from AWS / VPN / Tor exit IPs are attackers, they will add countermeasures.
- rosser 8y agoThen in deploying those countermeasures, they should know they're creating (sometimes significant) friction in the experience those legitimate users, who have legitimate reasons for using those tools, have of their site. Well-intentioned or not, the UX sucks, and I generally bail and don't come back if I experience a second Captcha in a session. Find a better solution, or accept that you're driving away eyeballs/revenue.
- zaarn 8y agoAs mentioned, this is a numbers game. Usually when this is deployed the cost of fighting the attackers exceeds any income the legitimate users via VPN or Tor respectively could provide.
- sievebrain 8y agoThey already know that and don't care.
- coatmatter 8y ago> Find a better solution, or accept that you're driving away eyeballs/revenue. Let's approach this from another angle for a moment - a hypothetical provider with no numbers/revenue; zero, zip. Where should they start? Do they start by chasing every possible user out there and risk a wave of spam, etc? No, right now - the Cloudflare approach is looking rather attractive despite Cloudflare not needing to advertise these security features far and wide (unlike some VPN providers) because we're talking so much about it. In the time that this debate will end, the buttons will be clicked, site(s) will be launched and working without problem for the majority of users it will be targeted at. For nearly everyone, this appears to be a much better solution than those that have plagued various online forums and services for years. So who is going to find a "better" solution? Probably almost nobody. As the other commenter says, it's a numbers game. And that's just business.
- technion 8y agoDefinitely in line with your statement, I ran a forum for years. At one point I found an iptables script that blocked all known Tor endpoints. What happened was, trolls posting gore and porn to a child oriented forum (which had persisted for 2-3 years) immediately and totally stopped. People in these threads point out that "criminals can use a VPN", but in practice it never happened to us. I never once heard from anyone that a legitimate user was impacted.