51–60 of 122 posts
Earlier quoted context omitted.
But if we're talking about The Adversary, then they're already deeper in than CloudFlare will ever be, so... what's different?
The difference is that reCAPTCHA provides a detectable traffic pattern and is already widely deployed. This provides plausible deniability. Other than that, I don't see a difference.
Earlier quoted context omitted.
It has enough detail: The claim is that an adversary who can measure traffic on CloudFlare's side (i.e. you) and the users ISP (i.e. your hypothetical friend mallory) can collude by measuring and comparing the bursts of packets generated during puzzle solving on the ISP side and the receipt of said packets on CF's side. This information is enough to figure out that Alice wanted to reach example.com via TOR. This work…
But it's a Google-served reCAPTCHA so there's nothing to measure on CloudFlare. So I disagree that there's detail here. Need real technical detail to be able to take action. If this were a paper or PoC then would be different. If there's a way to do that then please report it to us.
Tor users on google fiber take note.
I stand by Cloudflare. So much malicious traffic comes through Tor that administrators need to do a lot to protect themselves from it.
https://blog.torproject.org/blog/one-cell-enough
Work on a client to try and mitigate the risk of timing attacks:
Earlier quoted context omitted.
Encryption doesn't obscure the size or frequency of requests.
It does obscure the size, maybe not the frequency. Best have JS disabled when you come across this.
Encryption does not inherently obscure the size of plaintext. Protocols may choose to pad plaintext for various reasons, and both Tor (since Tor always sends fixed-width cells) and TLS (when it uses a block cipher mode) do so. However, the amount of padding is typically small and can hardly be said to "obscure" the size of a request - it is not a defense against traffic analysis.
This short piece doesn't have much detail. But if reCAPTCHA is usable to deanonymize Tor users then I would like to know about it in detail so I can do something about it.
It has enough detail: The claim is that an adversary who can measure traffic on CloudFlare's side (i.e. you) and the users ISP (i.e. your hypothetical friend mallory) can collude by measuring and comparing the bursts of packets generated during puzzle solving on the ISP side and the receipt of said packets on CF's side. This information is enough to figure out that Alice wanted to reach example.com via TOR. This work…
I'm almost positive these claims are completely false, for example:
> Cloudflare can conveniently serve few more images to specific users
> Each click on one of the images in the puzzle generates a total of about 50 packets between Tor user's computer and the Cloudflare's server (about half are requests and half are real-time responses from the server.)
> The packet group has predictable sizes and patterns, so all the adversary has to do is note the easily detectable signature of the "image click" event, and correlate it with the same on the Cloudflare side.
There is no API documentation in the reCAPTCHA widget about your server having to handle real-time requests from users solving the widget or serve images, so there is no Cloudflare side. It wouldn't make sense from an API perspective; why would I have to add a bunch of code to my server to handle this stuff? Google runs that. Look here:
https://developers.google.com/recaptcha/docs/display
Do you see a "handle real time image click events" API here for Cloudflare to deploy? You do not. Google would have to build backends for their machine learning and fraud detection algorithms in every language an API user would ever run, and then they also lose obscurity by shipping them. The image click events almost certainly go only to Google, never Cloudflare, so I think whoever sent this tip didn't understand what they were looking at in Wireshark.
The possible threat vector here is Google, not Cloudflare. Cloudflare just happens to have deployed Google's reCAPTCHA widely. The article is misleading and incredibly light on important detail; how about even a screenshot of a packet capture showing traffic to Cloudflare? If you want my honest take, I read this as a Tor user annoyed they have to solve reCAPTCHAs on Cloudflare sites (the "insistence" and quoted "protects" bits are the clue) and looking for something to hit them with, and a lack of diligence on Cryptome's part before posting it.
https://www.gstatic.com/recaptcha/api2/r20160712125018/recap... is the current version of the widget if anybody is curious, but I haven't looked closely.
It is an USA company - that is enough to not trust them. We do not need any more evidence, there is enough out there about gag orders, secret courts, worldwide compromise of network security. USA tec company inhabitants and founders, read this: please move out of the country, build your companies in other places, do it now. There is no time to waste. You can not repair the system, that corrupt bureaucrats have irreve…
It's bizarre that this article is critical of Cloudflare. If TOR can't stand up to a recaptcha without leaking PII, then it sounds like TOR ultimately needs to be fixed. I stand by Cloudflare. So much malicious traffic comes through Tor that administrators need to do a lot to protect themselves from it.
It is an USA company - that is enough to not trust them. We do not need any more evidence, there is enough out there about gag orders, secret courts, worldwide compromise of network security. USA tec company inhabitants and founders, read this: please move out of the country, build your companies in other places, do it now. There is no time to waste. You can not repair the system, that corrupt bureaucrats have irreve…
Why the downvotes?