3 ms·

So visiting cloudflare sites with TOR requires you to identify yourself? That's not great.

by swiley 5y ago

fuckyouriotshit 5y ago
Edit: I re-read the section on the U2F batch keys and understand that the design intent is to be unable to track individual tokens across sites (only batches of a size decided by the token manufacturer). It's not completely clear to me if the crypto involved is resistant to an attacker who can collect the handshakes and then later gets access to the key(s) that meant to be private to the manufacturer(s), but I acknowledge that the intent is decent. My points still stand, however. This sort of "we can solve that problem; we just need to kill your privacy" seems to be par-for-the-course in SV-style companies. I really wonder if anyone involved with building these systems has ever seriously thought about what could happen if the data collected (or that could be collected) by these systems was obtained by an adversary. Not to mention the incredible incentive problems that are created by designing things that are designed in a way that _requires_ that individuals are tracked across the internet. I know that CloudFlare is just one of many companies that is moving in this direction and they're certainly not the worst offenders when it comes to slowly murdering individual privacy (Facebook and Google are obviously far worse) but they have a uniquely powerful position due to the number of sites that use their DDoS protection and seem to be taking a casual disregard to the damage that they can do to people's privacy.
ignoramous 5y ago
They implemented Privacy Pass for that, which is kind of neat [0] and related to another standard for authn viz. OPAQUE that I really like [1]. [0] https://github.com/privacypass https://github.com/privacypass [1] https://news.ycombinator.com/item?id=25346632 https://news.ycombinator.com/item?id=25346632
ComodoHacker 5y ago
Can you see the difference between 'identify yourself' and 'prove you're human'?
- swiley 5y ago
  No?
fuckyouriotshit 5y ago
Visiting many CloudFlare sites with Tor was impossible the last time I checked because their CAPTCHA is broken and has been for a long time. I know for a fact that there are staff at CloudFlare who are aware of this problem but nothing has changed, so I guess that they don't care that they are making some sites unavailable to anyone who has to use Tor.

So visiting cloudflare sites with TOR requires you to identify yourself? That's not great.

by swiley 5y ago

So visiting cloudflare sites with TOR requires you to identify yourself? That's not great.

Edit: I re-read the section on the U2F batch keys and understand that the design intent is to be unable to track individual tokens across sites (only batches of a size decided by the token manufacturer). It's not completely clear to me if the crypto involved is resistant to an attacker who can collect the handshakes and then later gets access to the key(s) that meant to be private to the manufacturer(s), but I acknowledge that the intent is decent. My points still stand, however. This sort of "we can solve that problem; we just need to kill your privacy" seems to be par-for-the-course in SV-style companies. I really wonder if anyone involved with building these systems has ever seriously thought about what could happen if the data collected (or that could be collected) by these systems was obtained by an adversary. Not to mention the incredible incentive problems that are created by designing things that are designed in a way that _requires_ that individuals are tracked across the internet. I know that CloudFlare is just one of many companies that is moving in this direction and they're certainly not the worst offenders when it comes to slowly murdering individual privacy (Facebook and Google are obviously far worse) but they have a uniquely powerful position due to the number of sites that use their DDoS protection and seem to be taking a casual disregard to the damage that they can do to people's privacy.

ignoramous 5y ago

They implemented Privacy Pass for that, which is kind of neat [0] and related to another standard for authn viz. OPAQUE that I really like [1]. [0] https://github.com/privacypass https://github.com/privacypass [1] https://news.ycombinator.com/item?id=25346632 https://news.ycombinator.com/item?id=25346632

ComodoHacker 5y ago

Can you see the difference between 'identify yourself' and 'prove you're human'?

swiley 5y ago
No?

fuckyouriotshit 5y ago

Visiting many CloudFlare sites with Tor was impossible the last time I checked because their CAPTCHA is broken and has been for a long time. I know for a fact that there are staff at CloudFlare who are aware of this problem but nothing has changed, so I guess that they don't care that they are making some sites unavailable to anyone who has to use Tor.