Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare ReCAPTCHA De-Anonymizes Tor Users

cryptome.org

Post reply on HN
Print view View original

11–20 of 122 posts

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#11

Post by majke »

gnud wrote: post #8

I wonder why these anti-abuse systems don't use proof-of-work. Instead of a captcha, let the browser chug for 5 seconds, and then POST the solution in order to gain a temporary access cookie. Sure, this could be attacked - but not at scale, and that's the whole point of the capchta anyway, right?

Browsers vary drastically in javascript performance. Counting something can take couple of milliseconds on your desktop and seconds on some old mobile phone.

Ok, so you could differentiate the work for User-Agent, but then one could spoof user-agent to get less work. Going this route is not gonna be simple.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#12

Post by mikeash »

pyromine wrote: post #3

I didn't realize just how fragile TOR is. . . While I understand that remaining anonymous requires adjusting your browser habits somewhat extensively, the fact that a ReCAPTCHA is enough to (theoretically) de-anonymize a user seems to me that it's not able to anonymize at all when browsing. While TOR may be useful for evading firewalls, my general perception of the project has changed from general anonymity tool to a…

That was exactly my reaction upon seeing the description of the problem. Seems like the title of the article should really be, "Tor kind of sucks at anonymizing users." If all it takes is 25 requests sent in quick succession, then surely half the web pages out there share this same problem just from loading various resources.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#14

Post by gnud »

mikegerwitz wrote: post #9
gnud wrote: post #8

I wonder why these anti-abuse systems don't use proof-of-work. Instead of a captcha, let the browser chug for 5 seconds, and then POST the solution in order to gain a temporary access cookie. Sure, this could be attacked - but not at scale, and that's the whole point of the capchta anyway, right?

That requires JavaScript. CloudFlare does have a JS-only challenge, which presumably does this type of thing, but this has a couple different problems. From a security perspective, you're executing arbitrary software, which is unwise, especially if you're looking for anonymity. The other issue is that the software is also proprietary. https://support.cloudflare.com/hc/en-us/articles/204191238-W... "During a JavaScrip…

Good point. The Cloudflare capthchas I've seen seemed to use Javascript, but maybe it's just incredibly good CSS.

Interestingly, while a javascript calculation might leak more information to CloudFlare (since they might collect other info beseides the result of a proof-of-work function), it would probably leak less to anyone trying to analyze tor traffic from the outside? Seems to me like it would be harder to correlate the two ends of the tor circuit.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#15

Post by mikeash »

majke wrote: post #11
gnud wrote: post #8

I wonder why these anti-abuse systems don't use proof-of-work. Instead of a captcha, let the browser chug for 5 seconds, and then POST the solution in order to gain a temporary access cookie. Sure, this could be attacked - but not at scale, and that's the whole point of the capchta anyway, right?

Browsers vary drastically in javascript performance. Counting something can take couple of milliseconds on your desktop and seconds on some old mobile phone. Ok, so you could differentiate the work for User-Agent, but then one could spoof user-agent to get less work. Going this route is not gonna be simple.

I set up a system like this for my blog comments. The work was a couple of orders of magnitude slower in the browser than it would be in native code. That means that if my users have to burn 30 seconds of CPU time, an adversary could potentially burn 0.3 seconds of CPU time per spam comment, which is not all that significant. Bumping it up beyond that makes the user experience suck, and this is for a comment system where you still have to spend time writing the comment. For just loading a web page, anything over a second or two will hurt.

It's fine for my purposes, because I have no dedicated adversaries to combat, just occasional small-time spammers. But CloudFlare has a tougher time.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#16

Post by mikegerwitz »

gnud wrote: post #14
mikegerwitz wrote: post #9

Earlier quoted context omitted.

That requires JavaScript. CloudFlare does have a JS-only challenge, which presumably does this type of thing, but this has a couple different problems. From a security perspective, you're executing arbitrary software, which is unwise, especially if you're looking for anonymity. The other issue is that the software is also proprietary. https://support.cloudflare.com/hc/en-us/articles/204191238-W... "During a JavaScrip…

Good point. The Cloudflare capthchas I've seen seemed to use Javascript, but maybe it's just incredibly good CSS. Interestingly, while a javascript calculation might leak more information to CloudFlare (since they might collect other info beseides the result of a proof-of-work function), it would probably leak less to anyone trying to analyze tor traffic from the outside? Seems to me like it would be harder to correl…

It'd be harder to do traffic analysis, yes, though I really wonder why it makes so many requests to begin with. I'd like to see an analysis of the CAPTCHA.

Considering that they allow it without JS enabled, I wonder why they'd need any requests at all.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#17

Post by nickpsecurity »

walrus01 wrote: post #6
pyromine wrote: post #3

I didn't realize just how fragile TOR is. . . While I understand that remaining anonymous requires adjusting your browser habits somewhat extensively, the fact that a ReCAPTCHA is enough to (theoretically) de-anonymize a user seems to me that it's not able to anonymize at all when browsing. While TOR may be useful for evading firewalls, my general perception of the project has changed from general anonymity tool to a…

If I were a national signals intelligence agency with a correspondingly huge multi-billion dollar budget, it would be trivial to run a large percentage of tor exit nodes... You could probably achieve it with 500 individual 1U servers colocated with random hosting companies around the globe at a budget of $250/mo * 500 = $125,000/mo, which is a tiny drop in the bucket compared to the traffic analysis capability it wou…

I formulated the attack myself with your numbers seeming similar. It's one of reasons I didn't trust Tor. The success rate described in Snowden docs indicate NSA might be doing this experimentally. I don't think they're fully committed to point where they're running most nodes or anything. Being careful.

The difficulties wouldn't be as much as it seems. They probably wouldn't even be shut down that often. Just a small number of high-bandwidth nodes from front companies would net them a lot of intel. They could also partner with Five Eyes and Euro agencies as they all seem to want to de-anonymize Tor users. Each could have fronts doing it with their own operational techniques to muddy the situation up. Again, probably already do in a small way.

We haven't even discussed QUANTUM-ing the Tor servers. They really, really need memory-safe machines & implementations from CPU up if they're expecting to withstand high-strength attackers. Haven't looked at code or supported OS's in a while but I'm guessing default implementation doesn't fit that bill. ;)

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#18

Post by nitrogen »

walrus01 wrote: post #6
pyromine wrote: post #3

I didn't realize just how fragile TOR is. . . While I understand that remaining anonymous requires adjusting your browser habits somewhat extensively, the fact that a ReCAPTCHA is enough to (theoretically) de-anonymize a user seems to me that it's not able to anonymize at all when browsing. While TOR may be useful for evading firewalls, my general perception of the project has changed from general anonymity tool to a…

If I were a national signals intelligence agency with a correspondingly huge multi-billion dollar budget, it would be trivial to run a large percentage of tor exit nodes... You could probably achieve it with 500 individual 1U servers colocated with random hosting companies around the globe at a budget of $250/mo * 500 = $125,000/mo, which is a tiny drop in the bucket compared to the traffic analysis capability it wou…

Hypothetically an intelligence agency could "persuade" hosting companies not to shut down their boxes. One could speculate that they might do so by staging an investigation of their own box, thus getting two boxes in place.
Post reply on HN