3 ms·

Ironically, Cloudflare's default protections is probably the largest contributor to any radical usage of TOR. It's assumed you've a subversive motive since it's

Ironically, Cloudflare's default protections is probably the largest contributor to any radical usage of TOR. It's assumed you've a subversive motive since it's impossible to navigate the open web with it. Edit: I'm also not sure what "attacks" and "hacking attempts" mean. I'm guessing credential stuffing of admin pages? Brute-forcing the SSH password for root? These also can be prevented in a myriad other ways that doesn't disenfranchise TOR users.

zinekeller 5y ago
> Brute-forcing the SSH password for root? Not in this context. Cloudflare-protected pages don't need to worry that. > I'm guessing credential stuffing of admin pages? More complex than that, but you've got the point. Funnily, there is silence on Fastly's filter - sure, it's not active until you toggle it, but even without explicit Tor block you get the same result.
- prophesi 5y ago
  Can it not be defined beyond "it's complicated"?
  - zinekeller 5y ago
    It's quite hard, because it's not just "use known vulnerabilities on this specific address" - you can block it easily, and there are projects (such as CRS: https://github.com/coreruleset/coreruleset https://github.com/coreruleset/coreruleset) that tries to emulate this. It's more of combined specific attacks, which is amplified because if CloudFlare detected an attempt on a single high-profile site, then that IP address can be propagate to all of Cloudflare-protected "properties" (as they called it). Combine that with how random is an address allocated in Tor (and frequent rotations), and you've got blocks without using an explicit Tor list.
    - prophesi 5y ago
      > it's not just "use known vulnerabilities on this specific address" Ok, so they're not blocking complicated attacks. Just automation of attempts to exploit known vulnerabilities. And then their IP is marked as high risk. Rinse and repeat until the majority of TOR nodes are blocked. Definitely can't see that causing issues for TOR (or VPN) users. Edit: And to comment on this: > Funnily, there is silence on Fastly's filter > Cloudflare is used by 80.6% of all the websites whose reverse proxy service we know. This is 17.4% of all websites. https://w3techs.com/technologies/details/cn-cloudflare https://w3techs.com/technologies/details/cn-cloudflare > Fastly is used by 5.7% of all the websites whose reverse proxy service we know. This is 1.2% of all websites. https://w3techs.com/technologies/details/cn-fastly https://w3techs.com/technologies/details/cn-fastly

zinekeller 5y ago

> Brute-forcing the SSH password for root? Not in this context. Cloudflare-protected pages don't need to worry that. > I'm guessing credential stuffing of admin pages? More complex than that, but you've got the point. Funnily, there is silence on Fastly's filter - sure, it's not active until you toggle it, but even without explicit Tor block you get the same result.

prophesi 5y ago
Can it not be defined beyond "it's complicated"?
- zinekeller 5y ago
  It's quite hard, because it's not just "use known vulnerabilities on this specific address" - you can block it easily, and there are projects (such as CRS: https://github.com/coreruleset/coreruleset https://github.com/coreruleset/coreruleset) that tries to emulate this. It's more of combined specific attacks, which is amplified because if CloudFlare detected an attempt on a single high-profile site, then that IP address can be propagate to all of Cloudflare-protected "properties" (as they called it). Combine that with how random is an address allocated in Tor (and frequent rotations), and you've got blocks without using an explicit Tor list.
  - prophesi 5y ago
    > it's not just "use known vulnerabilities on this specific address" Ok, so they're not blocking complicated attacks. Just automation of attempts to exploit known vulnerabilities. And then their IP is marked as high risk. Rinse and repeat until the majority of TOR nodes are blocked. Definitely can't see that causing issues for TOR (or VPN) users. Edit: And to comment on this: > Funnily, there is silence on Fastly's filter > Cloudflare is used by 80.6% of all the websites whose reverse proxy service we know. This is 17.4% of all websites. https://w3techs.com/technologies/details/cn-cloudflare https://w3techs.com/technologies/details/cn-cloudflare > Fastly is used by 5.7% of all the websites whose reverse proxy service we know. This is 1.2% of all websites. https://w3techs.com/technologies/details/cn-fastly https://w3techs.com/technologies/details/cn-fastly