91–100 of 172 posts
Earlier quoted context omitted.
What I do is simply check if CF-IPCountry header == "T1" and block those from being able to register accounts. T1 is Tor.
Do the same on the login page. You have to stop the bots from trying to brute force user accounts and passwords.
That shouldn't be an issue if the passwords have enough entropy.
Walk into a bank with a face mask on, and see how they react. Same principle here.
You should be able to walk up to a vending machine with a face mask on. That's a more apt analogy.
Maybe to get around this the vending machine could ask for an identity card to confirm this person was safe.
In the same way, could Cloudflare (or anybody else) cookie people who were deemed safe? Sure. But then that sort of defeats the purpose of Tor.
From the perspective of somebody operating these systems: they are either damned if they do, damned if they don't. Given the relatively small number of people using Tor, I think what has been done here is perfectly reasonable.
Earlier quoted context omitted.
Do the same on the login page. You have to stop the bots from trying to brute force user accounts and passwords.
> You have to stop the bots from trying to brute force user accounts and passwords. That shouldn't be an issue if the passwords have enough entropy.
Allow me to optimize your statement.
>>> if FalseI fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate". A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a…
Actually probably not very much traffic is from tor. Tor bandwidth is notoriously bad.
Some time around ~2 years ago, though, the particular use-case of using Tor to (anonymously) access public-Internet websites got a lot better—both in bandwidth and TTFB.
Access to Tor hidden services is still slow, though.
Which makes me wonder: is the Tor network itself unilaterally faster now, and it's actually just the particular Tor hidden services which are all coincidentally bandwidth-starved?
Comparing apples to apples, DuckDuckGo's hidden-service gateway (https://3g2upl4pq6kufc4m.onion/) still seems a lot worse-off than their clear-net website (https://duckduckgo.com/). And I would bet that they would scale their Tor gateway if they could. So maybe this is a limitation in how Tor handles routing to hidden services? Does a .onion have to route to one physical Tor node, rather than being capable of load-balancing among many?
I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate". A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a…
The answer to your first question according to Cloudflare is 94% of Tor traffic is malicious, circa 2016: https://blog.cloudflare.com/the-trouble-with-tor/
The old question: is a simple ping considered an attack? I still here people talking of how their websites are attacked thousands of times every day. Pings and other simple scans are not what I would call actual attacks.
This shouldn’t be necessary. We changed our handling of Tor so long ago that I’ve forgotten how long go it was. If you are using the Tor Browser Bundle you should not see a CAPTCHA. If you do please report it to us.
In future, I'll report CAPTCHAs with Tor browser to Cloudflare. But I can imagine that other CDNs use Google CAPTCHAs, so I'll check for that first.
Earlier quoted context omitted.
The answer to your first question according to Cloudflare is 94% of Tor traffic is malicious, circa 2016: https://blog.cloudflare.com/the-trouble-with-tor/
94% of all traffic on the internet is malicious. It all depends on your definitions. A legitimate, human, user makes a handful of connections per minute. Someone running a scanner attempts thousands per second. So if we measure attempted connections then Tor and everything is horrible. But that true for actual bandwidth. The old question: is a simple ping considered an attack? I still here people talking of how their…
Do we have any sources regarding how that 94% number was calculated or are you guessing?
Background on tor problems: https://blog.cloudflare.com/the-trouble-with-tor/
and The Tor Projects response to that: https://blog.torproject.org/trouble-cloudflare They have been in this dispute with each other for a long time.
Earlier quoted context omitted.
blog.torproject.org uses an invalid security certificate. This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate.
You may be behind a corporate firewall that is blocking access to the site.
Earlier quoted context omitted.
What I do is simply check if CF-IPCountry header == "T1" and block those from being able to register accounts. T1 is Tor.
I run dedicated onion addresses for my sites and check the CF-IPCountry headers and just redirect Tor users to the Onion site.