5 ms·

It's up the the site owner if they want to block Tor or not, the site owner cloud just as easily have blocked Tor if they where using a normal server.

Asooka 5y ago
But is blocking Tor a decision the site owner has to make, or is it the default and requiring you to set up custom site protection rules if you want to accept Tor traffic?
- zinekeller 5y ago
  Explicit, using the special "country code" T1. However, I also noticed that natural blockrates (on my non-CF servers) tends to be higher on Tor exit addresses due to (seemingly) more aggressive hacking attempts - probably the same on CF (the real anonymity of Tor is both a blessing and a curse)
  - prophesi 5y ago
    You can explicitly block all TOR nodes, but by default the security settings is set to "Medium" which blocks the majority of them. I'd also like to know Cloudflare's definition of "malicious traffic". I think the main fears are DDoS attacks (which is a nonexistent threat to the majority of site owners) and scraping email addresses for spam. Which can be addressed by informing site owners to use a contact form widget instead of putting their email on their contact page.
    - zinekeller 5y ago
      See my corollary comment on some of my non-CF servers and the blocking - Tor does provide important anonymity, and I understand that Cloudflare, which is bigger, can probably absorb it without much damage, but unfortunately Tor exit nodes have a much higher attack and hacking attempts than regular IP addresses. In high-security applications when anonymity is already lost anyway (logging into a bank, for example) it is reasonable, due to the inherent risk, to block Tor exit nodes.
      - prophesi 5y ago
        Ironically, Cloudflare's default protections is probably the largest contributor to any radical usage of TOR. It's assumed you've a subversive motive since it's impossible to navigate the open web with it. Edit: I'm also not sure what "attacks" and "hacking attempts" mean. I'm guessing credential stuffing of admin pages? Brute-forcing the SSH password for root? These also can be prevented in a myriad other ways that doesn't disenfranchise TOR users.
        zinekeller 5y ago
        > Brute-forcing the SSH password for root? Not in this context. Cloudflare-protected pages don't need to worry that. > I'm guessing credential stuffing of admin pages? More complex than that, but you've got the point. Funnily, there is silence on Fastly's filter - sure, it's not active until you toggle it, but even without explicit Tor block you get the same result.
        prophesi 5y ago
        Can it not be defined beyond "it's complicated"?
        zinekeller 5y ago
        It's quite hard, because it's not just "use known vulnerabilities on this specific address" - you can block it easily, and there are projects (such as CRS: https://github.com/coreruleset/coreruleset https://github.com/coreruleset/coreruleset) that tries to emulate this. It's more of combined specific attacks, which is amplified because if CloudFlare detected an attempt on a single high-profile site, then that IP address can be propagate to all of Cloudflare-protected "properties" (as they called it). Combine that with how random is an address allocated in Tor (and frequent rotations), and you've got blocks without using an explicit Tor list.
        prophesi 5y ago
        > it's not just "use known vulnerabilities on this specific address" Ok, so they're not blocking complicated attacks. Just automation of attempts to exploit known vulnerabilities. And then their IP is marked as high risk. Rinse and repeat until the majority of TOR nodes are blocked. Definitely can't see that causing issues for TOR (or VPN) users. Edit: And to comment on this: > Funnily, there is silence on Fastly's filter > Cloudflare is used by 80.6% of all the websites whose reverse proxy service we know. This is 17.4% of all websites. https://w3techs.com/technologies/details/cn-cloudflare https://w3techs.com/technologies/details/cn-cloudflare > Fastly is used by 5.7% of all the websites whose reverse proxy service we know. This is 1.2% of all websites. https://w3techs.com/technologies/details/cn-fastly https://w3techs.com/technologies/details/cn-fastly
    - zinekeller 5y ago
      I personally don't use CloudFlare but do manage a website which uses one for a job, and there's a button to mangle e-mail addresses, so I don't think this is their concern. DDoS attacks are surprisingly negligible, comparable for ordinary IPs, so I don't think that's what they're protecting at.
    - judge2020 5y ago
      > but by default the security settings is set to "Medium" which blocks the majority of them. Citation needed, as my Enterprise zone with security level set to 'high' doesn't block my own Tor visit (and /cdn-cgi/trace does indeed show loc=T1).
deleted 5y ago
[deleted]
goodpoint 5y ago
> It's up the the site owner if they want to block Tor or not No. Cloudflare does that automatically when the owner selects "high protection" without clarifying the impact of the choices or discouraging such practice. > the site owner cloud just as easily have blocked Tor if they where using a normal server Not at all, it's difficult to implement to the same level as cloudflare.
- judge2020 5y ago
  > Not at all, it's difficult to implement to the same level as cloudflare. https://check.torproject.org/torbulkexitlist https://check.torproject.org/torbulkexitlist
- junon 5y ago
  It is super easy to implement this at the same level as cloudflare. You just check the connection against the exit node lists.

Asooka 5y ago

But is blocking Tor a decision the site owner has to make, or is it the default and requiring you to set up custom site protection rules if you want to accept Tor traffic?

zinekeller 5y ago
Explicit, using the special "country code" T1. However, I also noticed that natural blockrates (on my non-CF servers) tends to be higher on Tor exit addresses due to (seemingly) more aggressive hacking attempts - probably the same on CF (the real anonymity of Tor is both a blessing and a curse)
- prophesi 5y ago
  You can explicitly block all TOR nodes, but by default the security settings is set to "Medium" which blocks the majority of them. I'd also like to know Cloudflare's definition of "malicious traffic". I think the main fears are DDoS attacks (which is a nonexistent threat to the majority of site owners) and scraping email addresses for spam. Which can be addressed by informing site owners to use a contact form widget instead of putting their email on their contact page.
  - zinekeller 5y ago
    See my corollary comment on some of my non-CF servers and the blocking - Tor does provide important anonymity, and I understand that Cloudflare, which is bigger, can probably absorb it without much damage, but unfortunately Tor exit nodes have a much higher attack and hacking attempts than regular IP addresses. In high-security applications when anonymity is already lost anyway (logging into a bank, for example) it is reasonable, due to the inherent risk, to block Tor exit nodes.
    - prophesi 5y ago
      Ironically, Cloudflare's default protections is probably the largest contributor to any radical usage of TOR. It's assumed you've a subversive motive since it's impossible to navigate the open web with it. Edit: I'm also not sure what "attacks" and "hacking attempts" mean. I'm guessing credential stuffing of admin pages? Brute-forcing the SSH password for root? These also can be prevented in a myriad other ways that doesn't disenfranchise TOR users.
      - zinekeller 5y ago
        > Brute-forcing the SSH password for root? Not in this context. Cloudflare-protected pages don't need to worry that. > I'm guessing credential stuffing of admin pages? More complex than that, but you've got the point. Funnily, there is silence on Fastly's filter - sure, it's not active until you toggle it, but even without explicit Tor block you get the same result.
        prophesi 5y ago
        Can it not be defined beyond "it's complicated"?
        zinekeller 5y ago
        It's quite hard, because it's not just "use known vulnerabilities on this specific address" - you can block it easily, and there are projects (such as CRS: https://github.com/coreruleset/coreruleset https://github.com/coreruleset/coreruleset) that tries to emulate this. It's more of combined specific attacks, which is amplified because if CloudFlare detected an attempt on a single high-profile site, then that IP address can be propagate to all of Cloudflare-protected "properties" (as they called it). Combine that with how random is an address allocated in Tor (and frequent rotations), and you've got blocks without using an explicit Tor list.
        prophesi 5y ago
        > it's not just "use known vulnerabilities on this specific address" Ok, so they're not blocking complicated attacks. Just automation of attempts to exploit known vulnerabilities. And then their IP is marked as high risk. Rinse and repeat until the majority of TOR nodes are blocked. Definitely can't see that causing issues for TOR (or VPN) users. Edit: And to comment on this: > Funnily, there is silence on Fastly's filter > Cloudflare is used by 80.6% of all the websites whose reverse proxy service we know. This is 17.4% of all websites. https://w3techs.com/technologies/details/cn-cloudflare https://w3techs.com/technologies/details/cn-cloudflare > Fastly is used by 5.7% of all the websites whose reverse proxy service we know. This is 1.2% of all websites. https://w3techs.com/technologies/details/cn-fastly https://w3techs.com/technologies/details/cn-fastly
  - zinekeller 5y ago
    I personally don't use CloudFlare but do manage a website which uses one for a job, and there's a button to mangle e-mail addresses, so I don't think this is their concern. DDoS attacks are surprisingly negligible, comparable for ordinary IPs, so I don't think that's what they're protecting at.
  - judge2020 5y ago
    > but by default the security settings is set to "Medium" which blocks the majority of them. Citation needed, as my Enterprise zone with security level set to 'high' doesn't block my own Tor visit (and /cdn-cgi/trace does indeed show loc=T1).

deleted 5y ago

[deleted]

goodpoint 5y ago

> It's up the the site owner if they want to block Tor or not No. Cloudflare does that automatically when the owner selects "high protection" without clarifying the impact of the choices or discouraging such practice. > the site owner cloud just as easily have blocked Tor if they where using a normal server Not at all, it's difficult to implement to the same level as cloudflare.

judge2020 5y ago
> Not at all, it's difficult to implement to the same level as cloudflare. https://check.torproject.org/torbulkexitlist https://check.torproject.org/torbulkexitlist
junon 5y ago
It is super easy to implement this at the same level as cloudflare. You just check the connection against the exit node lists.