151–160 of 172 posts
Earlier quoted context omitted.
What I do is simply check if CF-IPCountry header == "T1" and block those from being able to register accounts. T1 is Tor.
I run dedicated onion addresses for my sites and check the CF-IPCountry headers and just redirect Tor users to the Onion site.
Earlier quoted context omitted.
https://metrics.torproject.org/bandwidth.html Currently the network is processing ~125Gbit/s of traffic.
is there a way to see the average bandwidth a tor end user would get? seems like a good amount?
For exit traffic I don't believe there is a metric for average user speed. But, I just ran a 3 speed tests using different circuits and was getting 500-800KB/s download speeds on average.
Earlier quoted context omitted.
It wouldn't be surprising if hidden services had a lot better performance. Running a guard node is a lot less risky than an exit, so there's probably a lot more capacity available for traffic staying inside the network.
They perform quite worse: https://metrics.torproject.org/torperf.html?start=2018-05-15... https://metrics.torproject.org/torperf.html?start=2018-05-15... You can see that for a 5MiB file, hidden services perform 2-3 times slower, I would put most of the blame on data having to travel through more hops when using hidden services.
I've got enough problems on my sites from Tor that I simply block T1 (Cloudflare's "country" code for Tor users) on their settings. Blocking whole countries used to be a Enterprise only feature, but now it's available to Pro users.
Note: Allowing non-enterprise to block countries was a bug, see https://community.cloudflare.com/t/code-10016/28039/13?u=jud...
Earlier quoted context omitted.
It's not about whether your personal use of VPN is legitimate. It's a numbers game. For any successful site that deals in user generated content, moderation is hard and relentless work. If they observe that a high fraction of visitors from AWS / VPN / Tor exit IPs are attackers, they will add countermeasures.
Then in deploying those countermeasures, they should know they're creating (sometimes significant) friction in the experience those legitimate users, who have legitimate reasons for using those tools, have of their site. Well-intentioned or not, the UX sucks, and I generally bail and don't come back if I experience a second Captcha in a session. Find a better solution, or accept that you're driving away eyeballs/reve…
Earlier quoted context omitted.
Hmmm, this sounds really interesting! Do we have any sources regarding how that 94% number was calculated or are you guessing?
Run a firewall on a server. Count every ping/scan as an attempted hack. Say you have 1000 legitimate users in a give day. You will probably see 1000 pings, scans, and other general junk per hour. (This is hard to do in places like cloudflare that filter much of this junk traffic before it hits their customers.)
What I wanted to know was some background on the 94% figure, do we now this is how they arrived at that number?
Earlier quoted context omitted.
>>> if the passwords have enough entropy. Allow me to optimize your statement. >>> if False
What does it mean? Users always pick low-entropy passwords?
Earlier quoted context omitted.
It's not about whether your personal use of VPN is legitimate. It's a numbers game. For any successful site that deals in user generated content, moderation is hard and relentless work. If they observe that a high fraction of visitors from AWS / VPN / Tor exit IPs are attackers, they will add countermeasures.
Then in deploying those countermeasures, they should know they're creating (sometimes significant) friction in the experience those legitimate users, who have legitimate reasons for using those tools, have of their site. Well-intentioned or not, the UX sucks, and I generally bail and don't come back if I experience a second Captcha in a session. Find a better solution, or accept that you're driving away eyeballs/reve…