Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You don’t want to be on Cloudflare’s naughty list

ctrl.blog

Post reply on HN
Print view View original

211–220 of 354 posts

Re: You don’t want to be on Cloudflare’s naughty list

#211

Post by unwise-exe »

mhink wrote: post #203
jabbany wrote: post #179

Earlier quoted context omitted.

An alternative that preserves some privacy also doesn't seem that hard to imagine... though it probably has its own can of worms*. Basically, the core problem is digital identities (accounts, IPs, phone #s etc.) are cheap to create (even considering captchas and all) so fraud is easy. The solution could be just to make it "costly" to create new digital identities. For example, you could get a "verified but anonymous"…

> Basically, the core problem is digital identities (accounts, IPs, phone #s etc.) are cheap to create (even considering captchas and all) so fraud is easy. The solution could be just to make it "costly" to create new digital identities. For example, you could get a "verified but anonymous" identity issued by locking some assets (could be real world money, or maybe something intangible like community reputation) as c…

That's not safe for a lot of sites, though.

I hear that porn tends to be officially frowned on in a fair number of places.

Reading non-approved news is dangerous in some places.

Honestly debating political topics can be super dangerous if you're identifiable.

Sometimes even having a login on a site is dangerous, I think I heard about this after a non-mainstream discussion site got hacked like a hear and a half ago.

Re: You don’t want to be on Cloudflare’s naughty list

#212

Post by JohnFen »

mh- wrote: post #45
TakeBlaster16 wrote: post #33

Earlier quoted context omitted.

Can you acknowledge the main point of the article? What should someone do if they find themselves misclassified by Cloudflare's systems?

(not the parent commenter) That person should start with the assumption they haven't been misclassified and eliminate the possibility that a device on their network is compromised.

A task that would be made much easier and less likely to miss something if the affected person had some indication as to what the problem was.

Re: You don’t want to be on Cloudflare’s naughty list

#213

Post by plumeria »

Zak wrote: post #193
thaumaturgy wrote: post #171

Earlier quoted context omitted.

I'm sorry. I have a colleague based out of Venezuela. We've had to work together to get tunnels and vpns configured so that he can get uncensored and secure internet access. But Tor is an enormous source of abusive traffic and if I don't filter it, then that's harmful to site owners. I'm being forced to choose between the needs of people that I know, work with, and depend on financially, and the needs of people in co…

There are probably more sophisticated options that would solve your problems than simply blocking it.

Is using CAPTCHAs one of those?

Re: You don’t want to be on Cloudflare’s naughty list

#214

Post by plumeria »

thaumaturgy wrote: post #143
dmix wrote: post #62

Earlier quoted context omitted.

Cloudflare just isn't worth the tradeoffs: the risks associated with their centralization, how they made Tor basically unusable on non-onion sites, the lack of transparency when content-moderating the internet, etc. The space is in need of solid competitors to break the stranglehold they have on the internet. Whether it's the right combination of services, documentation, etc.

Tor made Tor unusable on non-onion sites. I feed a netfilters table with the list of exit node IPs that Tor publishes ( https://check.torproject.org/torbulkexitlist ) as a standard part of server deployment, and it's the single most effective way to reduce form and login abuse on hosted sites. I like the idea of Tor, but there's no denying that it's a huge source of nuisances.

How often is the list of exit nodes updated?

Re: You don’t want to be on Cloudflare’s naughty list

#215

Post by thaumaturgy »

parroteal wrote: post #197
thaumaturgy wrote: post #171

Earlier quoted context omitted.

I'm sorry. I have a colleague based out of Venezuela. We've had to work together to get tunnels and vpns configured so that he can get uncensored and secure internet access. But Tor is an enormous source of abusive traffic and if I don't filter it, then that's harmful to site owners. I'm being forced to choose between the needs of people that I know, work with, and depend on financially, and the needs of people in co…

I'm a noob, can you give me a pointer? What kind of abusive traffic is coming through Tor and why do they do it?

Mainly forms -- login forms, comment forms, signup forms. Bots use Tor pretty heavily because it's anonymous and hard to block them without blocking the entire network. Login form abuse is mildly irritating but not a huge deal if you have other measures in place. Comment spam is annoying but there are some options that deal with it pretty well.

But the signup spam was a headache. I didn't want to just blackhole Tor traffic, and tried to reduce the abuse with other tools, including some custom stuff. The final straw was a customer's small business site that had a MailChimp or Constant Contact signup form. Those vendors want you to embed their code by default to render the form, so you have less control over the form itself. There were workarounds, but they all sucked.

Tor bots would sign up email addresses through this newsletter form, and then I'd have to go through and manually scrub them before newsletters went out, or the service would penalize my client for too many bounces/unsubscribes/complaints. Very nearly 100% of the abuse on that particular form came from Tor IPs.

I do not want to spend my limited time on this Earth manually sorting out bots from humans because of one particular network. Blackholing Tor made that problem disappear immediately.

VPNs are dime-a-dozen now, cheap VPSs are available from lots of vendors, there's Wireguard, there's ssh, a clever person could even set up Apache or nginx as a forward proxy with ssl from LetsEncrypt. Tor is well over 90% abusive traffic (https://blog.cloudflare.com/the-trouble-with-tor/). This is a Tor problem, not a me problem. There are better alternatives available.

Re: You don’t want to be on Cloudflare’s naughty list

#216

Post by [deleted] »

malfist wrote: post #70
DethNinja wrote: post #8

There is a chance you might’ve been hacked. You would be surprised to see how easy it is to hack domestic routers. 1. Find and disinfect the devices, including the router. If you don’t have enough technical knowledge, then buy a new router. 2. Use 30 character long random password on the router. 3. Disable UPnP. 4. Anything with WI-FI and weak password can be hacked within minutes, so check your other devices as well…

Why would you disable UPnP? You're gonna break most collaboration tools/video games/etc.

[deleted]

Re: You don’t want to be on Cloudflare’s naughty list

#217

Post by buildbot »

JohnFen wrote: post #212
mh- wrote: post #45

Earlier quoted context omitted.

(not the parent commenter) That person should start with the assumption they haven't been misclassified and eliminate the possibility that a device on their network is compromised.

A task that would be made much easier and less likely to miss something if the affected person had some indication as to what the problem was.

Devil's advocate - would it not then be pretty easy to engineer malicious bots to avoid detection?

Re: You don’t want to be on Cloudflare’s naughty list

#218

Post by LinuxBender »

toast0 wrote: post #120
LinuxBender wrote: post #40

Earlier quoted context omitted.

He's quite tame compared to me I suppose. I block anything that is not HTTP/2.0 which currently knocks out all the bots and all crawlers except Bing. But I just have hobby sites these days. Nobody would notice or care if my sites went offline. Using NGinx as an example: if ($server_protocol != HTTP/2.0) { return 403 'Nope'; } Another thing I have found useful to drops some bots is to become invisible to them. Many of…

> Many of the poorly written scanning tools do not properly set MSS for reasons I still don't understand. MSS issues attract me like a moth to flame [1], so let me ask some questions. It looks like this is dropping syns with MSS over 16384??? That is indeed a pretty crazy high number. 9000ish seems reasonable for someone on a jumbo network without a mss clamping router, but above that is someone weird for sure. Under…

You are right. I just happen to use a very safe range. If I didn't care about anyone using jumbo frames I could set the range to 1220:1536 and nearly all legit traffic would pass just fine. 1220 (to 13xx) for the people using VPN's and ip6-ip4 gateways. I just try to give really conservative examples so that it is less likely I break someones unusual setup. Anything just over 9k is fine for most jumbo-frame setups.

All of this said, I could set the range to 1:65536 and it would still drop most bots as they don't even bother to set MSS at all in their scans. I'm not sure which tool they are using.

Re: You don’t want to be on Cloudflare’s naughty list

#219

Post by cowtools »

judge2020 wrote: post #206
Zak wrote: post #193

Earlier quoted context omitted.

There are probably more sophisticated options that would solve your problems than simply blocking it.

Such as?

The answer depends on the type of service you host. I don't know what you need to do, but I do know that filtering IP space is merely security-by-obscurity, it is a cheap and broken solution to the hard problems of sybil resistance. If you need IP filtering to operate on a day-to-day basis, then the security of your service is fundamentally broken.

Tor users do not have any special properties over clear-net users besides low accountability for their IP space. There are other ways to acquire this type of setup that don't involve broadcasting a public list of known exit nodes as an act of good faith. Any sophisticated attacker will be able to easily get ahold of the IP space and bandwidth they need to do their work, whether it's through a botnet or simply because they operate out of some less-accountable country like China or Russia.

IP filtering: now you have two problems!

Re: You don’t want to be on Cloudflare’s naughty list

#220

Post by thaumaturgy »

cowtools wrote: post #219
judge2020 wrote: post #206

Earlier quoted context omitted.

Such as?

The answer depends on the type of service you host. I don't know what you need to do, but I do know that filtering IP space is merely security-by-obscurity, it is a cheap and broken solution to the hard problems of sybil resistance. If you need IP filtering to operate on a day-to-day basis, then the security of your service is fundamentally broken. Tor users do not have any special properties over clear-net users bes…

This is why I'm strongly against spam filtering for email. Spam filters are fundamentally security-through-obscurity. I mean, they don't protect your email from targeted bombing attacks or phishing. If you need spam filters to operate your email on a day-to-day basis, then the security of your email is fundamentally broken.

/s, obviously, I hope.

Blocking Tor isn't a security measure, it's a nuisance reduction measure.

Post reply on HN