The Trouble with CloudFlare

Post by kuschku » Fri, Apr 01, 2016, 5:51 PM UTC

jcoffland wrote: post #109

AnthonyMouse wrote: post #83

Earlier quoted context omitted.

The main point of Tor is that nobody knows where the traffic comes from. Realize you're asking them to break their own service. Your premise seems to be that you can't be bothered to protect your networks so you want to put that responsibility on someone else. It's called intermediary liability and it's terrible because the intermediary has all the wrong incentives. You demand that the intermediary eliminate maliciou…

Google does this with Linode servers. I route my HTTP traffic through a proxy on a Linode server. Google blocks me all the time for no reason other than that some other IPs in my range are doing bad things. I've tried to contact Google about this but they could care less about a handful of users.

Post by falcolas » Fri, Apr 01, 2016, 5:54 PM UTC

markonen wrote: post #151

jcoffland wrote: post #124

Earlier quoted context omitted.

Absolutely not. I believe in privacy and have zero tolerance for big businesses who throw their weight around at the expense of minority communities (Tor users in this case). I understand CloudFlare's need to make a profit. That is why we need to turn treating Tor traffic like normal traffic into a good business decision.

You misunderstand the problem. The issue is that CloudFlare is treating Tor traffic like any other traffic. What you want is special treatment for Tor above and beyond the whitelisting feature CloudFlare already offers to site owners.

Post by kuschku » Fri, Apr 01, 2016, 5:57 PM UTC

Klathmon wrote: post #92

CodeWriter23 wrote: post #85

Earlier quoted context omitted.

When every .html resource requested is met with a captcha, access is effectively banned.

Well that's another problem. When you fill out the captcha you are given a cookie that can allow cloudflare to let you through next time. If you are blocking that cookie for privacy reasons (which is not a bad thing!), then cloudflare has no way to verify you again (short of doing nefarious things). It's a bit of a self inflicted problem at that point. That's not to say that the answer is "deal with it", but that we…

Post by kuschku » Fri, Apr 01, 2016, 6:00 PM UTC

pfg wrote: post #145

kristofferR wrote: post #90

The main problem with CloudFlare is how dumb their "protection" is. It doesn't make sense at all to block Tor users from just accessing read-only content, like CloudFlare does today. Forms/login pages/comment boxes etc should be protected of course, and most people wouldn't have anything against solving a captcha for logging in, but preventing people from just reading stuff anonymously/securely is borderline evil fro…

This was addressed in CloudFlare's blog post: > One suggestion has been that we treat GET requests for static content differently than we do more risky requests like POSTs. We actually already do treat more dangerous requests differently than less risky requests. The problem is Tor exit nodes often have very bad reputations due to all the malicious requests they send, and you can do a lot of harm just with GETs. Cont…

Post by sp332 » Fri, Apr 01, 2016, 6:00 PM UTC

fweespee_ch wrote: post #182

sp332 wrote: post #144

Earlier quoted context omitted.

Yes, reputation is a form of tracking. And if you show up to a site with no reputation of your own, from an IP that has a known-bad reputation, it is in the best interest of the site to challenge (not block) you. You are 97% likely to be malicious traffic. Edit: 97% is a real number, not an exaggeration, based on numbers from the report linked in the article.

Yes, but Tor flips through IP addresses regularly so you'd get challenged every few minutes. Similarly, if you block cookies/supercookies/etc to avoid being tracked ... you'll be challenged every view.