3 ms·

Not to mention their disgraceful Tor captchas.

by RpPr 11y ago

jamespo 11y ago
Why do you think they have implemented these? Just to inconvenience you?
- lucb1e 11y ago
  (Another Tor browser user here.) Yes, it sure seems so. Half the time I visit Hacker News (which is behind Cloudflare) I have to fill in a captcha. I'm logged in with a 3k rep account and I'm not trying to do any action, I'm just trying to see the front page. That is surely suspicious enough to give me a captcha every ten minutes. Edit: to respond to both comments at once: alright Cloudflare may not recognize my HN cookie and account, but they do have two cf_* cookies, and I am merely loading the homepage. No weird URL parameters, no POST data, nothing.
  - jamespo 11y ago
    Are you suggesting cloudflare should hook into HN to check your reputation, I'm not sure they have the engineering capacity to extend this to all sites.
  - jtdowney 11y ago
    To be fair, Cloudflare has no concept of how much reputation you have on HN.
  - d23 11y ago
    Dude, you're assuming that from that same exact IP address they aren't getting a ton of other traffic that isn't spamming the hell out of them or doing completely sketchy stuff. That's what happens when you share an IP address with other people -- especially those who might be criminals or have other nefarious motives for using tor.
    - lucb1e 11y ago
      And that's why IP banning is a silly thing in IPv4. In Italy there is CGNAT widely deployed for years and Asian ISPs have big trouble obtaining IPv4 addresses as well. Dude.
- RpPr 11y ago
  They're the only major internet provider I know that consistently has difficulty providing adequate service to Tor browser users in the common case. They've even acknowledged that they're doing an unsatisfactory job of it, but still haven't gotten around to improving their system in several months.
  - eastdakota 11y ago
    It's a hard problem. The challenge is the vast majority of the traffic we see across Tor is malicious. I don't mean malicious in a normative/political sense (e.g., visiting a controversial site) I mean it in the sense that it is trying to harm the visited site (e.g., spam, SQL injection, etc.). Our customers sign up for us to protect them from these malicious visitors. Tor makes users individually anonymous -- which I think is extremely important for the health of the Internet -- but the challenge is that then means we have to fall back on less granular data when assessing a visitor's reputation (e.g., an IP address). CAPTCHAs are an imperfect way of differentiating malicious and non-malicious users both coming from a space where we see a majority of attempted harmful requests. Agree it's not perfect, but we haven't yet come up with a way to respect anonymity, protect our customers from attacks, and not introduce some additional annoyance/friction to good users on shared networks with a large amount of malicious traffic like Tor. To be clear, we don't disfavor (or favor) Tor exit nodes. The reputation of their IPs is generated automatically, just like the reputation of a company's VPN or your home router. People have suggested we provide our customers a way to whitelist all of Tor's nodes. We could do that, but I worry it may have the opposite of the intended effect. The vast majority of our customers, if given the ability to apply a rule to the Tor network, would choose to blacklist it entirely. While not the HN crowd, most site owners see Tor as a source of their headaches (e.g., credit card fraud, spam, trolling, hacking attempts, etc.). I'm not sure how we can build a system to allow customers to identify a set of IPs to whitelist without also allowing them to blacklist those IPs. I've been the voice internally who has resisted providing a selector on Tor but, maybe counter intuitively, because I am worried about not further harming the network's ability to allow users to surf the network anonymously. All that said, I agree right now our solution is far from perfect. I believe long term we'll always add a bit of friction to anonymous, shared networks but I think we can make it less painful/annoying. A number of very high profile individuals ranging from human rights activists to ACLU attorneys to even Edward Snowden and Julian Assange have personally asked me to, please!, make it better. A significant portion of our team is working to improve the experience for legitimate anonymized visitors without putting our customers at more risk. We've gotten incrementally better, but we're far from perfect. If you have ideas on how we can be better while still offering the protection our customers hire us for, send them our way or, better yet, come work with us. This is a hard engineering and Internet policy problem that there isn't a silver bullet solution for but that making progress on will have an enormously positive impact to millions of Internet users globally.
- middleclick 11y ago
  I can record a screencast in which I enter the right CAPTCHA and CloudFare still refuses to let me in, repeatedly, when I am using the Tor Browser. This happens to a point that I just give up because life is too short to enter right CAPTCHAs and still see CloudFlare complain.
christop 11y ago
Supposedly they're working on that: https://www.youtube.com/watch?v=QdVL54l-VWY#t=25m11 https://www.youtube.com/watch?v=QdVL54l-VWY#t=25m11

Not to mention their disgraceful Tor captchas.

by RpPr 11y ago

Not to mention their disgraceful Tor captchas.

jamespo 11y ago

Why do you think they have implemented these? Just to inconvenience you?

lucb1e 11y ago
(Another Tor browser user here.) Yes, it sure seems so. Half the time I visit Hacker News (which is behind Cloudflare) I have to fill in a captcha. I'm logged in with a 3k rep account and I'm not trying to do any action, I'm just trying to see the front page. That is surely suspicious enough to give me a captcha every ten minutes. Edit: to respond to both comments at once: alright Cloudflare may not recognize my HN cookie and account, but they do have two cf_* cookies, and I am merely loading the homepage. No weird URL parameters, no POST data, nothing.
- jamespo 11y ago
  Are you suggesting cloudflare should hook into HN to check your reputation, I'm not sure they have the engineering capacity to extend this to all sites.
- jtdowney 11y ago
  To be fair, Cloudflare has no concept of how much reputation you have on HN.
- d23 11y ago
  Dude, you're assuming that from that same exact IP address they aren't getting a ton of other traffic that isn't spamming the hell out of them or doing completely sketchy stuff. That's what happens when you share an IP address with other people -- especially those who might be criminals or have other nefarious motives for using tor.
  - lucb1e 11y ago
    And that's why IP banning is a silly thing in IPv4. In Italy there is CGNAT widely deployed for years and Asian ISPs have big trouble obtaining IPv4 addresses as well. Dude.
RpPr 11y ago
They're the only major internet provider I know that consistently has difficulty providing adequate service to Tor browser users in the common case. They've even acknowledged that they're doing an unsatisfactory job of it, but still haven't gotten around to improving their system in several months.
- eastdakota 11y ago
  It's a hard problem. The challenge is the vast majority of the traffic we see across Tor is malicious. I don't mean malicious in a normative/political sense (e.g., visiting a controversial site) I mean it in the sense that it is trying to harm the visited site (e.g., spam, SQL injection, etc.). Our customers sign up for us to protect them from these malicious visitors. Tor makes users individually anonymous -- which I think is extremely important for the health of the Internet -- but the challenge is that then means we have to fall back on less granular data when assessing a visitor's reputation (e.g., an IP address). CAPTCHAs are an imperfect way of differentiating malicious and non-malicious users both coming from a space where we see a majority of attempted harmful requests. Agree it's not perfect, but we haven't yet come up with a way to respect anonymity, protect our customers from attacks, and not introduce some additional annoyance/friction to good users on shared networks with a large amount of malicious traffic like Tor. To be clear, we don't disfavor (or favor) Tor exit nodes. The reputation of their IPs is generated automatically, just like the reputation of a company's VPN or your home router. People have suggested we provide our customers a way to whitelist all of Tor's nodes. We could do that, but I worry it may have the opposite of the intended effect. The vast majority of our customers, if given the ability to apply a rule to the Tor network, would choose to blacklist it entirely. While not the HN crowd, most site owners see Tor as a source of their headaches (e.g., credit card fraud, spam, trolling, hacking attempts, etc.). I'm not sure how we can build a system to allow customers to identify a set of IPs to whitelist without also allowing them to blacklist those IPs. I've been the voice internally who has resisted providing a selector on Tor but, maybe counter intuitively, because I am worried about not further harming the network's ability to allow users to surf the network anonymously. All that said, I agree right now our solution is far from perfect. I believe long term we'll always add a bit of friction to anonymous, shared networks but I think we can make it less painful/annoying. A number of very high profile individuals ranging from human rights activists to ACLU attorneys to even Edward Snowden and Julian Assange have personally asked me to, please!, make it better. A significant portion of our team is working to improve the experience for legitimate anonymized visitors without putting our customers at more risk. We've gotten incrementally better, but we're far from perfect. If you have ideas on how we can be better while still offering the protection our customers hire us for, send them our way or, better yet, come work with us. This is a hard engineering and Internet policy problem that there isn't a silver bullet solution for but that making progress on will have an enormously positive impact to millions of Internet users globally.
middleclick 11y ago
I can record a screencast in which I enter the right CAPTCHA and CloudFare still refuses to let me in, repeatedly, when I am using the Tor Browser. This happens to a point that I just give up because life is too short to enter right CAPTCHAs and still see CloudFlare complain.

christop 11y ago

Supposedly they're working on that: https://www.youtube.com/watch?v=QdVL54l-VWY#t=25m11 https://www.youtube.com/watch?v=QdVL54l-VWY#t=25m11