4 ms·

Tor is different. We don't put up CAPTCHAs by default for Tor. We totally changed how we handle Tor years ago. But, because Tor provides anonymity, there is _a

Tor is different. We don't put up CAPTCHAs by default for Tor. We totally changed how we handle Tor years ago. But, because Tor provides anonymity, there is _a lot_ of abuse through it. A lot.

tyingq 8y ago
I read the privacy sections in your blog post, and it feels like WARP offers anonymity, maybe not from CF, but perhaps from everyone else.
- jerf 8y ago
  Tone note: I'm posting technically, not value-judging. I would say "anonymity" is a fairly strong term for what's being offered here. It's going to hide your source IP, and if you don't mind CF seeing your unencrypted content (and the fact it's unencrypted kinda means that from a technical perspective, you already don't care), it may improve the amount of the connection to unencrypted content that is encrypted (and thereby block the "coffee shop" attack fairly well), but that's all. They're not going to actively strip the bajillions of other active tracking techniques being used nowadays. Your phone will still track location. Facebook will still track you on your phone every bit as much as they did before. etc. This is part of a complicated set of measures you may be able to take to attain anonymity, but not even remotely the full package. Again, this is a technical posting to ensure that people understand what this is and is not. This is not a criticism of the service for not being something it isn't or anything like that. Less technically and more value-judgy (though still not much), note the title: "Introducing Warp: Fixing Mobile Internet Performance and Security" Performance was highlighted first, security second. This seems to me to be a reasonable and accurate reflection of the nature of the service.
- jgrahamc 8y ago
  Note that the blog post does not say "anonymity" or any similar word. We aren't trying to hide you completely from everyone (use Tor for that). We are securing and accelerating the connection between your device and Cloudflare. This is meant to deal with the reliability, performance and security challenges of using mobile Internet around the world. And we have strong privacy guarantees.
  - tyingq 8y ago
    Yes, I got that. But, because CF offerings are very popular, you're going to end up with a lot of people coming from a relatively small number of IP addresses, right? It's worth thinking about...we had this situation before with AOL. That is, a pretty large number of people in diverse geographic areas, all coming from a small number of IP addresses. People do use that "relative" anonymity for lots of things, not all of them good. Also, it may create some issues for things like geolocation, regional content restrictions, credit card fraud detection, SMTP blacklisting, rate limiting, and so forth. Because your offering is free, and CF is well known, I'm guessing it will grow fast. Not suggesting anything change about it, just that it may create something that site owners need to react to.

Tor is different. We don't put up CAPTCHAs by default for Tor. We totally changed how we handle Tor years ago. But, because Tor provides anonymity, there is _a lot_ of abuse through it. A lot.

tyingq 8y ago

I read the privacy sections in your blog post, and it feels like WARP offers anonymity, maybe not from CF, but perhaps from everyone else.

jerf 8y ago
Tone note: I'm posting technically, not value-judging. I would say "anonymity" is a fairly strong term for what's being offered here. It's going to hide your source IP, and if you don't mind CF seeing your unencrypted content (and the fact it's unencrypted kinda means that from a technical perspective, you already don't care), it may improve the amount of the connection to unencrypted content that is encrypted (and thereby block the "coffee shop" attack fairly well), but that's all. They're not going to actively strip the bajillions of other active tracking techniques being used nowadays. Your phone will still track location. Facebook will still track you on your phone every bit as much as they did before. etc. This is part of a complicated set of measures you may be able to take to attain anonymity, but not even remotely the full package. Again, this is a technical posting to ensure that people understand what this is and is not. This is not a criticism of the service for not being something it isn't or anything like that. Less technically and more value-judgy (though still not much), note the title: "Introducing Warp: Fixing Mobile Internet Performance and Security" Performance was highlighted first, security second. This seems to me to be a reasonable and accurate reflection of the nature of the service.
jgrahamc 8y ago
Note that the blog post does not say "anonymity" or any similar word. We aren't trying to hide you completely from everyone (use Tor for that). We are securing and accelerating the connection between your device and Cloudflare. This is meant to deal with the reliability, performance and security challenges of using mobile Internet around the world. And we have strong privacy guarantees.
- tyingq 8y ago
  Yes, I got that. But, because CF offerings are very popular, you're going to end up with a lot of people coming from a relatively small number of IP addresses, right? It's worth thinking about...we had this situation before with AOL. That is, a pretty large number of people in diverse geographic areas, all coming from a small number of IP addresses. People do use that "relative" anonymity for lots of things, not all of them good. Also, it may create some issues for things like geolocation, regional content restrictions, credit card fraud detection, SMTP blacklisting, rate limiting, and so forth. Because your offering is free, and CF is well known, I'm guessing it will grow fast. Not suggesting anything change about it, just that it may create something that site owners need to react to.