3 ms·

They're the only major internet provider I know that consistently has difficulty providing adequate service to Tor browser users in the common case. They've ev

by RpPr 11y ago

They're the only major internet provider I know that consistently has difficulty providing adequate service to Tor browser users in the common case. They've even acknowledged that they're doing an unsatisfactory job of it, but still haven't gotten around to improving their system in several months.

eastdakota 11y ago
It's a hard problem. The challenge is the vast majority of the traffic we see across Tor is malicious. I don't mean malicious in a normative/political sense (e.g., visiting a controversial site) I mean it in the sense that it is trying to harm the visited site (e.g., spam, SQL injection, etc.). Our customers sign up for us to protect them from these malicious visitors. Tor makes users individually anonymous -- which I think is extremely important for the health of the Internet -- but the challenge is that then means we have to fall back on less granular data when assessing a visitor's reputation (e.g., an IP address). CAPTCHAs are an imperfect way of differentiating malicious and non-malicious users both coming from a space where we see a majority of attempted harmful requests. Agree it's not perfect, but we haven't yet come up with a way to respect anonymity, protect our customers from attacks, and not introduce some additional annoyance/friction to good users on shared networks with a large amount of malicious traffic like Tor. To be clear, we don't disfavor (or favor) Tor exit nodes. The reputation of their IPs is generated automatically, just like the reputation of a company's VPN or your home router. People have suggested we provide our customers a way to whitelist all of Tor's nodes. We could do that, but I worry it may have the opposite of the intended effect. The vast majority of our customers, if given the ability to apply a rule to the Tor network, would choose to blacklist it entirely. While not the HN crowd, most site owners see Tor as a source of their headaches (e.g., credit card fraud, spam, trolling, hacking attempts, etc.). I'm not sure how we can build a system to allow customers to identify a set of IPs to whitelist without also allowing them to blacklist those IPs. I've been the voice internally who has resisted providing a selector on Tor but, maybe counter intuitively, because I am worried about not further harming the network's ability to allow users to surf the network anonymously. All that said, I agree right now our solution is far from perfect. I believe long term we'll always add a bit of friction to anonymous, shared networks but I think we can make it less painful/annoying. A number of very high profile individuals ranging from human rights activists to ACLU attorneys to even Edward Snowden and Julian Assange have personally asked me to, please!, make it better. A significant portion of our team is working to improve the experience for legitimate anonymized visitors without putting our customers at more risk. We've gotten incrementally better, but we're far from perfect. If you have ideas on how we can be better while still offering the protection our customers hire us for, send them our way or, better yet, come work with us. This is a hard engineering and Internet policy problem that there isn't a silver bullet solution for but that making progress on will have an enormously positive impact to millions of Internet users globally.
- RpPr2 11y ago
  Thanks for replying to this, it's good to see you recognize this as an issue. Some thoughts based off this: It's clear that these captchas are 95% broken, the fact that these ones are so unreadable suggests the more readable ones were solved, so apparently this implementation can't last in any case. For what it's worth I would have no problem filling out captchas if they're readable, and other places on the internet do still have readable captchas. Another reading here is that Cloudflare has sold a product to its customers (hacking protection) that other cloud providers have not attempted to sell. I'm going to be harsh and call that negative externalities for Tor users. And I'm not sure that product even works as advertised - a scan of the internet can reveal the backend server, which could still be hacked (probably even more so, if the customer is now relying on Cloudflare to protect it). It seems we're talking about automated attacks only? Else the attacker could just fill out the captcha manually first. If a targeted attack can be detected (attacker has completed the captcha), just rely on that code instead? If not, have we gained much? Clearly a lot of customers will have blindly cranked their s3cur1ty bar to 11. Perhaps make it harder for a customer to do that, given the adverse impact it currently causes? Most people probably think DoS when they head to Cloudflare, not free captchas. Note that I do mean "common case", because its weakens the anonymity set when normal people are hassled out of Tor. So just making "GET /boring-article.html$" work would be a great improvement. If that then lead to a work-flow of "POST /comment" -> 403, user notices, hits refresh and fills out a magically-appeared captcha, then so be it.. Tor users would learn this flow quick enough, and prefer it. I could totally ask and suggest ideas about this all day for free, but I won't be applying to Cloudflare for the time being fwiw :P Still, I'm grateful you're working on the issue.

by RpPr 11y ago

eastdakota 11y ago

It's a hard problem. The challenge is the vast majority of the traffic we see across Tor is malicious. I don't mean malicious in a normative/political sense (e.g., visiting a controversial site) I mean it in the sense that it is trying to harm the visited site (e.g., spam, SQL injection, etc.). Our customers sign up for us to protect them from these malicious visitors. Tor makes users individually anonymous -- which I think is extremely important for the health of the Internet -- but the challenge is that then means we have to fall back on less granular data when assessing a visitor's reputation (e.g., an IP address). CAPTCHAs are an imperfect way of differentiating malicious and non-malicious users both coming from a space where we see a majority of attempted harmful requests. Agree it's not perfect, but we haven't yet come up with a way to respect anonymity, protect our customers from attacks, and not introduce some additional annoyance/friction to good users on shared networks with a large amount of malicious traffic like Tor. To be clear, we don't disfavor (or favor) Tor exit nodes. The reputation of their IPs is generated automatically, just like the reputation of a company's VPN or your home router. People have suggested we provide our customers a way to whitelist all of Tor's nodes. We could do that, but I worry it may have the opposite of the intended effect. The vast majority of our customers, if given the ability to apply a rule to the Tor network, would choose to blacklist it entirely. While not the HN crowd, most site owners see Tor as a source of their headaches (e.g., credit card fraud, spam, trolling, hacking attempts, etc.). I'm not sure how we can build a system to allow customers to identify a set of IPs to whitelist without also allowing them to blacklist those IPs. I've been the voice internally who has resisted providing a selector on Tor but, maybe counter intuitively, because I am worried about not further harming the network's ability to allow users to surf the network anonymously. All that said, I agree right now our solution is far from perfect. I believe long term we'll always add a bit of friction to anonymous, shared networks but I think we can make it less painful/annoying. A number of very high profile individuals ranging from human rights activists to ACLU attorneys to even Edward Snowden and Julian Assange have personally asked me to, please!, make it better. A significant portion of our team is working to improve the experience for legitimate anonymized visitors without putting our customers at more risk. We've gotten incrementally better, but we're far from perfect. If you have ideas on how we can be better while still offering the protection our customers hire us for, send them our way or, better yet, come work with us. This is a hard engineering and Internet policy problem that there isn't a silver bullet solution for but that making progress on will have an enormously positive impact to millions of Internet users globally.

RpPr2 11y ago
Thanks for replying to this, it's good to see you recognize this as an issue. Some thoughts based off this: It's clear that these captchas are 95% broken, the fact that these ones are so unreadable suggests the more readable ones were solved, so apparently this implementation can't last in any case. For what it's worth I would have no problem filling out captchas if they're readable, and other places on the internet do still have readable captchas. Another reading here is that Cloudflare has sold a product to its customers (hacking protection) that other cloud providers have not attempted to sell. I'm going to be harsh and call that negative externalities for Tor users. And I'm not sure that product even works as advertised - a scan of the internet can reveal the backend server, which could still be hacked (probably even more so, if the customer is now relying on Cloudflare to protect it). It seems we're talking about automated attacks only? Else the attacker could just fill out the captcha manually first. If a targeted attack can be detected (attacker has completed the captcha), just rely on that code instead? If not, have we gained much? Clearly a lot of customers will have blindly cranked their s3cur1ty bar to 11. Perhaps make it harder for a customer to do that, given the adverse impact it currently causes? Most people probably think DoS when they head to Cloudflare, not free captchas. Note that I do mean "common case", because its weakens the anonymity set when normal people are hassled out of Tor. So just making "GET /boring-article.html$" work would be a great improvement. If that then lead to a work-flow of "POST /comment" -> 403, user notices, hits refresh and fills out a magically-appeared captcha, then so be it.. Tor users would learn this flow quick enough, and prefer it. I could totally ask and suggest ideas about this all day for free, but I won't be applying to Cloudflare for the time being fwiw :P Still, I'm grateful you're working on the issue.