51–60 of 78 posts
Earlier quoted context omitted.
Pretty trivial to get a new IP address these days.
IP enumaration is also pretty trivial. I guess that what attackers might be using to "unhide" domains. Scan the net and request the required domain name?
Earlier quoted context omitted.
The biggest thing for me is that you can use secure WebSockets (wss://) without having to setup TLS on your origin server. This greatly improves the ability to establish WebSocket connections across proxies.
So what you want to do is fooling clients into believing there is transport encryption while actually there is none and the communication with the origin server happens in the clear?
Earlier quoted context omitted.
So what you want to do is fooling clients into believing there is transport encryption while actually there is none and the communication with the origin server happens in the clear?
From what I remember, CF actually requires an ssl certificate, but they'll accept a self-signed one (because they already validate ownership themselves.
Curious why they hadn't been doing this all along. This seems like low hanging fruit to add value. Maybe I'm missing something.
Earlier quoted context omitted.
So what you want to do is fooling clients into believing there is transport encryption while actually there is none and the communication with the origin server happens in the clear?
You're wrong now https://blog.cloudflare.com/cloudflare-ca-encryption-origin/
Earlier quoted context omitted.
You're wrong now https://blog.cloudflare.com/cloudflare-ca-encryption-origin/
It's not wrong, given that it's a reply to this statement: "... without having to setup TLS on your origin server." Strict mode is optional. It's certainly possible (and highly recommended!) to use transport encryption in both directions with CloudFlare, but that's not what jephir described here.
Not Tor users
Precisely. Because of CloudFlare's position regarding Tor users, along with the erroneous idea that an identity is an IP address, these changes do nothing for the Tor user and developer community at large. Tor is used for more than just routing around censorship. I use it to create a seamless network of all my computers all via hidden services. So every machine has a "hidden service domain name" of [hash].onion . Kno…
I have a site. Because the site is... disparaging to political figures, I want to run behind Tor as a hidden service. Now, CloudFlare is good at their core business, so I hire them to cache my .onion site for mass consumption. It also defends my .onion site from being slashdotted/reddit hug of death/HNbombed.
All the better if fellow Tor users access my site: I want people to consume/use my site. That's why it's published.
And here is CloudFlare, destroying Tor user's capability of using any site that hires CloudFlare. It's a completely ridiculous situation, and a horrid solution they ascribe to that does nobody any favors.
Now, they do have some valid reasons. And there can also be technological ways to solve it without shitcanning every Tor user.
1. Tarpit defense. Slow down connections that show 'harassing behaviors' No you don't need to see that webpage 100 times in a second.
2. Offer a CloudFlare.onion hidden service. There's no reason they can't get into Tor HS as well. Facebook already is.
3. Limit bandwidth to known Tor exit nodes. Don't block.
Earlier quoted context omitted.
It's not wrong, given that it's a reply to this statement: "... without having to setup TLS on your origin server." Strict mode is optional. It's certainly possible (and highly recommended!) to use transport encryption in both directions with CloudFlare, but that's not what jephir described here.
Why wouldn't you setup tls?? That makes no sense. By setup he means buying a cert
Earlier quoted context omitted.
Precisely. Because of CloudFlare's position regarding Tor users, along with the erroneous idea that an identity is an IP address, these changes do nothing for the Tor user and developer community at large. Tor is used for more than just routing around censorship. I use it to create a seamless network of all my computers all via hidden services. So every machine has a "hidden service domain name" of [hash].onion . Kno…
As an example where CloudFlare could be very useful is the following: (since I couldn't edit my parent comment) I have a site. Because the site is... disparaging to political figures, I want to run behind Tor as a hidden service. Now, CloudFlare is good at their core business, so I hire them to cache my .onion site for mass consumption. It also defends my .onion site from being slashdotted/reddit hug of death/HNbombe…
CloudFlare is not blocking exit nodes because of volumetric DDoS attacks. That's not really viable over Tor anyway. It's mostly to block comment spam, crawlers and vulnerability scans (e.g. SQLi), which is unfortunately often done through Tor in automated ways.
Also: Website owners using CloudFlare can whitelist Tor traffic if they so chose.
I don't see how 2) would change anything with regards to the blocking situation. All the aforementioned problems would still apply, the only difference would be that they'd lose the IP address as an identifier, making it even harder to filter malicious traffic. I'm not against CloudFlare implementing something like that, but I fail to see the relevancy and I do wonder if tunneling all hidden service traffic for a site through a centralized service (which needs access to the plaintext in order to do any kind of caching or filtering) is a good idea for a project like Tor.
Not Tor users
Precisely. Because of CloudFlare's position regarding Tor users, along with the erroneous idea that an identity is an IP address, these changes do nothing for the Tor user and developer community at large. Tor is used for more than just routing around censorship. I use it to create a seamless network of all my computers all via hidden services. So every machine has a "hidden service domain name" of [hash].onion . Kno…