8 ms·
Not to detract from the point but I find Cloudflare to be on the more reasonable side when it comes to blocking Tor. A lot of sites end up effectively banning a
by jchw 6y ago
Not to detract from the point but I find Cloudflare to be on the more reasonable side when it comes to blocking Tor. A lot of sites end up effectively banning all Tor IPs, Cloudflare merely requires CAPTCHA. And they do offer Privacy Pass as a sort of approach to make it a little less annoying.
- capableweb 6y ago> Cloudflare merely requires CAPTCHA I do agree that Privacy Pass is in theory a good idea, although to say that CloudFlare "merely" requires captchas to be filled out is a bit disingenuous. You're often required to complete 5-10 captchas, and sometimes even after that, you get denied. Had that happen to me multiple times.
- jchw 6y agoI don’t use Tor for all of my traffic, but sometimes I do use it just because I can. And my experience lately is that I usually get hCaptcha and I usually pass it once and get in. It’s Recaptcha that is a serious problem.
- croutonwagon 6y agoGoogle owned domains, namely Youtube, are even worse. They often redirect to different domains for blocks so just changing the circuit does nothing.
- akalsz 6y agoYeah after years of suffering from reCAPTCHA I'm somewhat thankful for hCaptcha. It is still annoying (especially Cloudflare's integration which seems barely compatible with the Tor Browser's cookie and circuit management), but at least I don't have to switch exit nodes twenty times just to have a chance of my solution being accepted (like with reCAPTCHA).
- mikequinlan 6y agoIf you can't pass a CAPTCHA, you need to stop and ask yourself -- are you really a human being, or have you just been programed to believe that you are?
- capableweb 6y agoActually a good point as I never even considered that. Maybe I'm the one who's at wrong here? Seemingly I am passing the captchas, they are not giving me any errors. Simply seems to accept my input, reload the page and ask me to do more.
- iaml 6y agoNot a valid question when google literally has a patent on unsolvable captcha. https://patents.google.com/patent/US9407661 https://patents.google.com/patent/US9407661
- kazinator 6y agoIf you have been trying to solve the same captcha for several hours, you need to stop and ask yourself -- are you really a human being, or have you just been programed to believe that you are?
- arbol 6y agoThis patent has expired due to non payment of fees
- Google234 6y agoThat’s also not google lol
- iaml 6y agoMy bad, I was referring to this comment [0] and didn't notice it was not actually owned by google. [0] https://news.ycombinator.com/item?id=16157480 https://news.ycombinator.com/item?id=16157480
- colinmhayes 6y ago
- 0df8dkdf 6y ago> You're often required to complete 5-10 captchas, and sometimes even after that, you get denied. Had that happen to me multiple times. Glad you mentioned it. This also has happened to me many time. It is unfortunate botnet and spam has give IP addresses bad names.
- grishka 6y agoDiscriminating IP addresses is a terrible idea to begin with. You're breaking the internet by doing it. Please treat all IPs equally.
- pepemon 6y agoNo, we won't. Many of those IPs are the origins for spam, botnets, crawlers, DDoS, exploitation engines, etc. The only feasible solution even with all modern heuristics and ML is still good ol' IP scoring and/or banning.
- catblast01 6y agoIt’s just silly to suggest this when quite simply not all IPs behave equally and the differences are not subtle. It’s annoying when “bad” IPs get reassigned and change, but that is a relatively infrequent event - and certainly CloudFlare is at least adaptive. It’s just not a principal aligned with reality.
- grishka 6y agoThe problem that no one seems to acknowledge: one IP doesn't necessarily mean one person or entity behind it. Residential ISPs often use a single public IP as an exit point for many subscribers simultaneously. So if one, just one, of these subscribers does something that our internet overlord Cloudflare considers nefarious, everyone else sharing this IP gets punished for doing nothing wrong.
- jbluepolarbear 6y agoThis specific problem happens all the time. That’s the ISPs problem, not cloudflare. The ISP has a user negatively impacting other users, best course of action would be remove that user and notify cloudflare after.
- grishka 6y agoDo ISPs actually do any of this? Does any ISP ever do any of this? I don't think so. Also, no one knows what was the particular thing that pissed off Cloudflare, because it's a black box. I'll say it again: centralizing the internet around a single company is a terrible idea. Especially so when said company terminates TLS and thus has access to unencrypted traffic.
- ffpip 6y ago> Cloudflare merely requires CAPTCHA. Cloudflare doesn't "require" captchas for TOR users. By default, they treat TOR IPs it like any other IP. However since a lot of traffic comes out of a TOR IP, it looks like bot traffic
- Sebb767 6y agoThey at least monitor TOR IPs. See this blog post [0] from 2016. https://blog.cloudflare.com/the-trouble-with-tor/ https://blog.cloudflare.com/the-trouble-with-tor/
- t0astbread 6y agoAs far as I know, Cloudflare transparently redirects some Tor users to their own hidden services and then uses the circuit ID for rate limiting: https://blog.cloudflare.com/cloudflare-onion-service/ https://blog.cloudflare.com/cloudflare-onion-service/ "Some" because they seem to have internal heuristics for detecting Tor Browser users before they enable that feature for a connection, so it doesn't apply to all connections made through Tor. YMMV I guess but I haven't seen a Cloudflare CAPTCHA over Tor in a long time.
- akalsz 6y agoI still wonder how that detection thing works. My custom Firefox setup with requests proxied through Tor passes as the TBB, but copying the same request as a curl command somehow doesn't.
- t0astbread 6y agoYeah, it's pretty weird and apparently it's being updated as well. Like, a year ago or so I wrote a browser extension to trick that detection mechanism when I'm on stock Firefox. Just when writing that comment I discovered something has changed and that's not needed anymore.
- m-p-3 6y agoAnd I found hCaptcha to be way less annoying than ReCaptcha when using Tor.
- rattray 6y agoI hadn't heard of "Privacy Pass" before. https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass... Sounds like it allows you to browse without tracking in a way that more reliably signals you're a human, which seems very useful. Why would a human browsing the internet with Tor not want to use Privacy Pass?
- dotancohen 6y ago> And they do offer Privacy Pass as a sort of > approach to make it a little less annoying. The Privacy Pass extension requires, as it mentions when installing it, access to all the data on all websites that you visit. So in order to stop getting so many Captchas, one has to give this company unfettered access to all sites that one visits? Why even bother with an HTTPS connection when the browser is potentially leaking the information away with explicit user consent? And I don't even use Tor. But every few weeks I'll have a two or three day spat where every webpage that I visit requires at least two captchas to be solved. Maybe another user from my ISP is scrapping, but I'm a good citizen on the 'net.
- deanclatworthy 6y agoTry signing up to gitlab and then signing in. It’s completely broke with TOR because of cloudflares crappy redirect and nobody has done anything about it. The captcha also breaks after you spend about thirty mins trying to find a relay which doesn’t trigger the redirect page protection loop.