Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Drastic increase in Tor clients from Germany

metrics.torproject.org

Post reply on HN
Print view View original

181–190 of 262 posts

Re: Drastic increase in Tor clients from Germany

#181

Post by hedora »

supriyo-biswas wrote: post #173
hartator wrote: post #170

Earlier quoted context omitted.

Why not CAPTCHA protect these pages instead of blocking tor? Same attack can go through regular web.

I already have per-IP ratelimiting, and I'm against using captchas have bad UX (including the much-hailed Turnstile). I'll probably migrate to some proof-of-work based schemes and some algorithms to detect anomalous requests, but it would require some engineering work on my part (for a free website FWIW), and the quickest way to mitigate it would be to block Tor.

IP blocking blocks most of the people on our local ISP. They are small, and use CGNAT, so one owned windows machine across town breaks sites like yours for everyone, and the root cause is extremely difficult to debug for end users.

As much as I deeply, deeply dislike captchas, ip blocking is far worse.

Re: Drastic increase in Tor clients from Germany

#182

Post by thissitesucks__ »

hattmall wrote: post #131
topynate wrote: post #67

Earlier quoted context omitted.

It's not clear to me how you'd do that with clients, rather than relays.

DDOS a hidden service and track the request spike through your exit nodes. I think this is how the original silk road was investigated.

Silk Road was a hidden service so exit nodes were not involved (they would use rendezvous points). If my recollection from American Kingpin is correct, Silk Road was caught because it leaked its IP address in error messages, and Ulbricht posted questions about bitcoin on Stack Overflow using the same name as the bitcointalk post announcing Silk Road. Its clearnet IP was visible for almost the entire lifespan of the site, I believe.

Re: Drastic increase in Tor clients from Germany

#183

Post by lost_tourist »

chronicsonic wrote: post #140
wood_spirit wrote: post #83

Clicking around and looking at the chart for random other countries shows a spike for Sweden too, whereas Finland has a different but interesting pattern all of its own.

Wonder if the fact that they’re related to NATO, who is at war, have anything to do with it.

I can think of a country currently at war that has a much more aggressive and longer history of being a bad actor on the internet than NATO countries...

Re: Drastic increase in Tor clients from Germany

#184

Post by hedora »

Most of the comments suggest strange conspiracy theories, but the traffic is an exponential ramp (drive into 2023). Also, there has been rapid growth in some neighboring countries.

It could be organic growth. There have apparently been a few wiretapping scandals this year; people may be using it to access Ukraine/Russia, and a bunch of laws passed last year that incentivize US companies to block EU traffic (to avoid fines for data leaks).

Any of those seem more plausible than a single actor renting a rack or dc in one country, and using tor to try to evade detection.

Re: Drastic increase in Tor clients from Germany

#185

Post by hedora »

sparkling wrote: post #45
V__ wrote: post #42

There is no way these are organic users. Could it be, that some VPN is using Germany as an entrypoint?

Why? VPN users mostly care about the Exit IP country, not the Entry IP country.

Some VPNs have a “then connect to tor” option for extra anonymity against malicious tor entrypoints and against your local ISP seeing that you are browsing tor [hosted sites].

Re: Drastic increase in Tor clients from Germany

#186

Post by mantas »

hedora wrote: post #179
mantas wrote: post #171

Earlier quoted context omitted.

Maybe German state itself is the actor.

What state actor doesn’t understand statistical deanoymization attacks against tor? (e.g., if you single-handedly double the network traffic, then an outside observer can figure out what ingress/egress traffic is yours)

Why pay attention to this if you can simply blame another state actor?

And German federal government have a history for covert shitposting.

Re: Drastic increase in Tor clients from Germany

#187

Post by aeyes »

ballenf wrote: post #165
riedel wrote: post #114

Earlier quoted context omitted.

The interesting question is if there is a bot net spreading in Germany since the 17th of June. What would be the likelihood of that going undetected. If you like conspiracy theory, the rise in one country could point to state actors.

Why would it be so localized to one country? Does Germany have a unique enemy compared to other NATO countries?

My guess is that a certain router is getting infected with a botnet because ISPs usually hand out the same router to their customers. And ISPs are usually limited to a single country.

Re: Drastic increase in Tor clients from Germany

#189

Post by RobotToaster »

supriyo-biswas wrote: post #173
hartator wrote: post #170

Earlier quoted context omitted.

Why not CAPTCHA protect these pages instead of blocking tor? Same attack can go through regular web.

I already have per-IP ratelimiting, and I'm against using captchas have bad UX (including the much-hailed Turnstile). I'll probably migrate to some proof-of-work based schemes and some algorithms to detect anomalous requests, but it would require some engineering work on my part (for a free website FWIW), and the quickest way to mitigate it would be to block Tor.

>I'll probably migrate to some proof-of-work based schemes and some algorithms to detect anomalous requests, but it would require some engineering work on my part

Have you tried mcaptcha? https://github.com/mCaptcha/mCaptcha

Re: Drastic increase in Tor clients from Germany

#190

Post by jacooper »

FinnKuhn wrote: post #175
sparkling wrote: post #84

Earlier quoted context omitted.

Doubt it. Hetzners smallest machine is something like $4/month, additional IPv4 addresses come with extra cost. They have quite tight service quotas, and this 2M additional IPs would be almost their entire IPv4 pool.

Hetzner was just an example, because they are a well known. Interestingly a similar sudden increase of German Tor users also happend in 2017: https://www.chip.de/news/Raetselhafter-Nutzeranstieg-Zahl-de... Hetzner (and other German entities) seem to operate quite a few relays though: https://metrics.torproject.org/rs.html#aggregate/as not sure if this might have something to do with it...

They don't operate the relays themselves, rather users install relays on hetzner vpses/servers.
Post reply on HN