6 ms·
What I do is simply check if CF-IPCountry header == "T1" and block those from being able to register accounts. T1 is Tor.
by Reedx 8y ago
What I do is simply check if CF-IPCountry header == "T1" and block those from being able to register accounts. T1 is Tor.
- Twisol 8y agoSource and more info: https://support.cloudflare.com/hc/en-us/articles/200168236-What-does-CloudFlare-IP-Geolocation-do- https://support.cloudflare.com/hc/en-us/articles/200168236-W...
- user5994461 8y agoDo the same on the login page. You have to stop the bots from trying to brute force user accounts and passwords.
- the8472 8y ago> You have to stop the bots from trying to brute force user accounts and passwords. That shouldn't be an issue if the passwords have enough entropy.
- user5994461 8y ago>>> if the passwords have enough entropy. Allow me to optimize your statement. >>> if False
- anticensor 8y agoWhat does it mean? Users always pick low-entropy passwords?
- judge2020 8y agoAlmost always. It's gotten better with the rise of password managers that generate random passwords, but otherwise, passwords are usually shared across many websites and usually less than 16 characters.
- rmc 8y agoNot "always". But you should not build your systems based on the assumption that passwords will be strong enough.
- topkeks 8y agoDon't allow shitty passwords. For example you could use HaveIBeenPwned API to reject previously leaked passwords.
- jstarfish 8y agoNo amount of entropy mitigates a successful credential stuffing attack.
- tedunangst 8y agoNo amount of anything mitigates a successful attack; otherwise it wouldn't be successful.
- Franciscouzo 8y agoIt could be argued that once you use a password more than once its entropy decreases automatically.
- Avamander 8y agoWhy not just captcha everyone?
- deftnerd 8y agoI run dedicated onion addresses for my sites and check the CF-IPCountry headers and just redirect Tor users to the Onion site.
- shortcutsolutn 8y agoWhy not add a checkmark like this: "[ ] I support dictatorship and want to live under a dictatorship. I don't believe in freedom of speech or expression on any subject, even banal everyday subjects. For all subjects, I oppose freedom of the press, freedom of speech, and the right to read anonymously or express anonymous opinions, regardless of content. If in America, I oppose the fourth amendment ('[t]he right of the people to be secure in their persons, houses, papers, and effects') and promise to vote to repeal it." Then only allow people who check it with an x to register. This should remove any legitimate Tor users from your demographics. --- EDIT: I got downvoted but I promise it will remove legitimate Tor users from your demographics. I just can't imagine any legitimate Tor user checking that checkbox. (By legitimate, I mean ones who are not abusive trolls etc. Of course abusive trolls won't mind checking that checkbox, before attempting to disrupt your site. My advice was on how to remove legitimate Tor users.)
- tzs 8y ago> I just can't imagine any legitimate Tor user checking that checkbox Legitimate Tor users will click it for the same reason a large fraction of users in general will click it--it's stopping them from getting where they want to be, and they believe clicking it enable them to move on, and they believe that reading it won't speed up that process. It's just to them more "stupid stuff the site wants me to agree to that I don't need to bother with because (1) if it is asking me to agree to some rules I don't care because I'm really nice and would never do anything they could object to anyway, and (2) if it is making me give permission to use my data or track me it doesn't matter because (I'm already tracked everywhere else | I've got ad blocking and privacy add-ons installed)".
- shortcutsolutn 8y agoGood point! Since my suggestion actually would not stop trolls (abusive users) anyway (they would just click it so they could then abuse the site), how about blocking all Tor traffic with this message: " Why we are blocking Tor users You appear not to support dictatorship and or want to live under a dictatorship. As the operator of this site, I don't believe in freedom of speech or expression on any subject, even banal everyday subjects. For all subjects, I oppose freedom of the press, freedom of speech, and the right to read anonymously or express anonymous opinions, regardless of content. If I could, I would repeal the fourth amendment ('[t]he right of the people to be secure in their persons, houses, papers, and effects'). Come back when you are ready to be tracked by your government." Fair compromise? It sends the message across while blocking all Tor users.