Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear customers of Cloudflare: an appeal regarding Tor

gitlab.com

Post reply on HN
Print view View original

61–70 of 172 posts

Re: Dear customers of Cloudflare: an appeal regarding Tor

#61

Post by homero »

philip1209 wrote: post #17
ShakataGaNai wrote: post #4

I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate". A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a…

It would be cool if you could set a header to Cloudflare when a user is logged in, perhaps with that user's ID. That could then trigger significantly decreased security.

Their workers feature can do all kinds of things like this

Re: Dear customers of Cloudflare: an appeal regarding Tor

#62

Post by kentonv »

bennofs wrote: post #42
jgrahamc wrote: post #25

This shouldn’t be necessary. We changed our handling of Tor so long ago that I’ve forgotten how long go it was. If you are using the Tor Browser Bundle you should not see a CAPTCHA. If you do please report it to us.

What's special about Tor Browser Bundle? What would I need to configure to use it with another browser?

Privacy Pass. https://privacypass.github.io/

Re: Dear customers of Cloudflare: an appeal regarding Tor

#63

Post by zackbloom »

For people who are unaware, there is a cryptographic solution to this. Cloudflare worked with crypto researchers to create a way for Tor users to anonymously verify that they're not a bot. It's called Privacy Pass and it solves this problem: https://blog.cloudflare.com/cloudflare-supports-privacy-pass...

Re: Dear customers of Cloudflare: an appeal regarding Tor

#64

Post by Nokinside »

staunch wrote: post #56
Nokinside wrote: post #33

Earlier quoted context omitted.

It's a trade-off. If you trust Cloudflare it adds additional protection against bad guys. If you don't trust them don't use them. Same with Amazon or any other place where you can rent server room. Using Cloudflare gives control for control over which part of their site can use shared cache and which is direct link. If you don't trust anyone, run your own servers and don't hire sysadmins.

> ... and don't hire sysadmins. People you hire can be vetted, fired, sued, and even imprisoned for violating your users' privacy. Blindly handing over your users' data to a third-party includes none of these protections. You're simply abdicating responsibility.

Okay then.

But you must have them on site 24/7 to be able to respond as fast as Couldfare to any new security issues. You must pay them a lots of money because they must be expert level. You also need to have 24/7 security around your servers and all the backups and redundancy.

Very few businesses have customer information that is wroth the paranoia and investment to doing everything inhouse.

Re: Dear customers of Cloudflare: an appeal regarding Tor

#65

Post by jstarfish »

omginternets wrote: post #24
lucb1e wrote: post #18

Criminals will just hire a botnet, as we can see from all incoming spam email and forum bots, etc. For the rest of us who desire to be anonymous online, there is Tor. Whatever people can do over Tor, they can also do without Tor. You're probably never going to find them anyway, even if you would sue in the first place. This whole tor vs clearnet distinction is way overblown. Sure people will do more crap if they're a…

>Criminals will just hire a botnet ... if Tor proves ineffective. If not, then they'll definitely use Tor.

Botnets are too unreliable. They're only any good for coordinating DoS attacks and spamming, the sorts of attacks that don't require persistence of infrastructure.

Tor is a common CnC and exfiltration vector. Nothing good will ever originate from a pseudoanonymous network developed for spycraft. We have enough problems with it that we shoot it on sight.

The bigger problem is becoming abuse of cheap VPS and seedbox services (and anon VPNs) to launch attacks. $5 gets you a non-attributable box managed by an overseas entity with a gigabit link and an IP strategically located near your target to thwart geoip-based blocking. With that price point and features, why fuck around with botnets or Tor?

Re: Dear customers of Cloudflare: an appeal regarding Tor

#66

Post by user5994461 »

Reedx wrote: post #21
ShakataGaNai wrote: post #4

I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate". A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a…

What I do is simply check if CF-IPCountry header == "T1" and block those from being able to register accounts. T1 is Tor.

Do the same on the login page. You have to stop the bots from trying to brute force user accounts and passwords.

Re: Dear customers of Cloudflare: an appeal regarding Tor

#67

Post by petagonoral »

mnm1 wrote: post #48

Those Google captchas are horrible. Often they do not let one of through despite giving seemingly correct answers. One is prompted with captcha after captcha after captcha. They not only require cookies, but JavaScript turned on and are a real affront to the whole idea of a usable, open web. On tor, I just give up. There is nothing I want to see on the internet badly enough that I'm willing to spend ten to fifteen mi…

not just tor. i use a commercial proxy and allow google store cookies yet i keep having to complete those captchas just because of my IP address..

seems like google could alleviate this if they checked value of certain cookies before making people repeatedly solve captchas.

Re: Dear customers of Cloudflare: an appeal regarding Tor

#68

Post by AckSyn »

ShakataGaNai wrote: post #4

I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate". A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a…

I'd like to not have to fill out a dozen captchas just to comment on something.

Re: Dear customers of Cloudflare: an appeal regarding Tor

#69

Post by user5994461 »

philip1209 wrote: post #17
ShakataGaNai wrote: post #4

I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate". A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a…

It would be cool if you could set a header to Cloudflare when a user is logged in, perhaps with that user's ID. That could then trigger significantly decreased security.

Cloudflare already does that automatically.

Re: Dear customers of Cloudflare: an appeal regarding Tor

#70

Post by dmitrygr »

fosco wrote: post #32
dmitrygr wrote: post #30

Earlier quoted context omitted.

Actually probably not very much traffic is from tor. Tor bandwidth is notoriously bad.

are there any researched measurements to show exactly how much is available? obviously it would vary greatly depending on where the connection is going... but wondering if there is some overarching idea of what it has..

Try using it. Very slow. No matter where you are. I understand that some people have no choice other than to use it. so I stopped using it to leave whatever bandwidth there is in the exit nodes to them
Post reply on HN