Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Trouble with CloudFlare

blog.torproject.org

Post reply on HN
Print view View original

201–210 of 361 posts

Re: The Trouble with CloudFlare

#201

Post by phw »

eastdakota wrote: post #75

Tor has acknowledged their "botnet problem" since at least 2013: https://research.torproject.org/techreports/botnet-tr-2013-1... That same paper walks through the challenges of dealing with it and doesn't find any satisfactory solutions. As I wrote in our post on the topic, there's a trade off between security, anonymity, and convenience. CloudFlare provides security to our customers. We believe in the importance of…

The bots in the "botnet problem" were connecting to a hidden service that was hosted in the Tor network. That isn't quite the same thing as bots that connect to hosts outside of Tor. Therefore, this isn't an issue for CloudFlare, and a bad example.

Re: The Trouble with CloudFlare

#202

Post by JakeTheAndroid »

ultramancool wrote: post #118
eastdakota wrote: post #115

Earlier quoted context omitted.

Yes, you can whitelist Tor. This is available at no cost for all customers regardless of plan level: https://support.cloudflare.com/hc/en-us/articles/203306930-D...

Thanks. Can I whitelist the whole internet (by using /0 perhaps?) using this method? I've seen people complaining about this issue on VPNs and such too.

You can whitelist CIDR ranges of /16 and /24 currently. So yes, you can to some extent whitelist everyone.

Re: The Trouble with CloudFlare

#203

Post by pfg »

kuschku wrote: post #187
pfg wrote: post #145

Earlier quoted context omitted.

This was addressed in CloudFlare's blog post: > One suggestion has been that we treat GET requests for static content differently than we do more risky requests like POSTs. We actually already do treat more dangerous requests differently than less risky requests. The problem is Tor exit nodes often have very bad reputations due to all the malicious requests they send, and you can do a lot of harm just with GETs. Cont…

That argument only holds true if the person operating the site has no idea at all about the HTTP standards. * GET requests have to be idempotent. * Security by Obscurity is not Security. * Content Scraping is nothing you have to protect against, or should protect against – DRM just does not work .

Right, but this is about abuse and solutions for that. Obviously, blocking Tor is not going to prevent a determined attacker from scraping your site or trying some SQLi vectors. It might, however, prevent a large number of bots from scraping your site for emails, scanning for vulnerabilities, or doing click fraud. It's not a perfect solution, but those rarely exist. CloudFlare sees a lot of malicious traffic, so they probably have a better view of what works and what doesn't compared to everyone else.

Re: The Trouble with CloudFlare

#204

Post by ultramancool »

kristofferR wrote: post #158
avip wrote: post #154

Earlier quoted context omitted.

"Read-only" pages are still fertile ground for layer 7 DDOS.

It wouldn't be hard to only display the captchas if sudden increased traffic from Tor exits indicated that a DDOS through Tor was in action.

Not only that but you could only display CAPTCHAs on the actual target of the DDoS.

Re: The Trouble with CloudFlare

#205

Post by [deleted] »

eastdakota wrote: post #75

Tor has acknowledged their "botnet problem" since at least 2013: https://research.torproject.org/techreports/botnet-tr-2013-1... That same paper walks through the challenges of dealing with it and doesn't find any satisfactory solutions. As I wrote in our post on the topic, there's a trade off between security, anonymity, and convenience. CloudFlare provides security to our customers. We believe in the importance of…

[deleted]

Re: The Trouble with CloudFlare

#206

Post by grey-area »

kristofferR wrote: post #129
ultramancool wrote: post #113

Earlier quoted context omitted.

Hi, I'm completely sympathetic to your problem - Tor is used by lots of spammers - totally understandable to try to prevent this spam from hitting your customers. But most of the services I run can't really be affected by this sort of spam (no public comment systems for example). I use CloudFlare on a few of my domains, if I don't care about bot traffic and just want to turn this CAPTCHA system off entirely, is there…

Yeah, I don't get why CloudFlare are so overaggressive with the captchas. The vast majority of captcha'd pages by CloudFlare on Tor which makes secure web browsing so cumbersome are completely read-only, while some may have a comment system hosted by a third party like Disqus and Facebook (and are therefore protected already). Other sites should have the captchas on a different level than the front page, like the log…

They also protect against ddos, sqli, overuse, bots etc. so comment spam is only one problem and get requests are not always safe.

You'd think they could be far more sophisticated about reputation though and adjust it in realtime so that ips are by default trusted and are marked down temporarily for bad behaviour.

Re: The Trouble with CloudFlare

#207

Post by mynameisvlad »

falcolas wrote: post #183
markonen wrote: post #151

Earlier quoted context omitted.

You misunderstand the problem. The issue is that CloudFlare is treating Tor traffic like any other traffic. What you want is special treatment for Tor above and beyond the whitelisting feature CloudFlare already offers to site owners.

> CloudFlare is treating Tor traffic like any other traffic I don't see this in any practical fashion. I can visit a CloudFlare hosted site from the regular internet for hours (even scrape automatically) with no problems; the first time I hit the same site through Tor, it gets a double or triple capchca. Perhaps it should be a blacklist instead of a whitelist. Defaults matter.

Of course you can visit it for hours, because you are most likely one of very few people who are accessing the CloudFlare netrwork from that IP. If you were to go through a public VPN, then the chance of captcha will also go up. The issue is that with higher traffic out of a single IP, there is a much higher likelihood of malicious activity.

A blacklist would do nothing to solve this, since the fundamental problem is the way Tor and VPNs work, by aggregating traffic into exit nodes at specific IPs.

Edit: And upon further thought, it most likely is a blacklist. A bunch of malicious requests go out from one IP, so that IP is blocked. Because it's an exit node, it also blocks a bunch of other legitimate people.

Re: The Trouble with CloudFlare

#208

Post by Klathmon »

kuschku wrote: post #185
Klathmon wrote: post #92

Earlier quoted context omitted.

Well that's another problem. When you fill out the captcha you are given a cookie that can allow cloudflare to let you through next time. If you are blocking that cookie for privacy reasons (which is not a bad thing!), then cloudflare has no way to verify you again (short of doing nefarious things). It's a bit of a self inflicted problem at that point. That's not to say that the answer is "deal with it", but that we…

Any proof of work concept again is just a cookie – because the proof I present will be the same.

But you could possibly re-do the proof of work every page load without the cognitive load of multiple captchas.

It still isn't ideal for mobile or low-end clients, but its something.

Re: The Trouble with CloudFlare

#209

Post by jjnoakes »

falcolas wrote: post #183
markonen wrote: post #151

Earlier quoted context omitted.

You misunderstand the problem. The issue is that CloudFlare is treating Tor traffic like any other traffic. What you want is special treatment for Tor above and beyond the whitelisting feature CloudFlare already offers to site owners.

> CloudFlare is treating Tor traffic like any other traffic I don't see this in any practical fashion. I can visit a CloudFlare hosted site from the regular internet for hours (even scrape automatically) with no problems; the first time I hit the same site through Tor, it gets a double or triple capchca. Perhaps it should be a blacklist instead of a whitelist. Defaults matter.

> I don't see this in any practical fashion.

You don't?

> I can visit a CloudFlare hosted site from the regular internet for hours (even scrape automatically) with no problems

Ah but this is not the same. Try doing so from an IP which is also sending malicious traffic, and you will see the same issue.

Re: The Trouble with CloudFlare

#210

Post by nxzero »

rfrank wrote: post #91
nxzero wrote: post #89

Earlier quoted context omitted.

Thanks, agree, I'd like to know exactly what was childish and happy to own up to it if true and attempt to fix the issue.

The number of hn users replying solely to tone and not content is pretty disappointing.

Possible it's tone, but also given the relatively low volume of voting, and it's unclear to me what if any steps HN takes to reduce abuse and fine tune community comment policies, it's very possible that something else is going on. For example, some users appear to have comment histories that are highly irregular; one comment suggesting Snowden should be invited to return to the US without any chance of being behind bars or worst, and in another appearing to state that the US has not overstepped their rights; which is possible, though strikes me as bit odd; 100% sure my comments to some are a bit odd, though do try to respond if a direct statement is expressed.
Post reply on HN