Cloudflare ReCAPTCHA De-Anonymizes Tor Users
cryptome.org
Cloudflare ReCAPTCHA De-Anonymizes Tor Users
1–10 of 122 posts
Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users
#2does that captcha works without JavaScript?
Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users
#3I didn't realize just how fragile TOR is. . . While I understand that remaining anonymous requires adjusting your browser habits somewhat extensively, the fact that a ReCAPTCHA is enough to (theoretically) de-anonymize a user seems to me that it's not able to anonymize at all when browsing.
While TOR may be useful for evading firewalls, my general perception of the project has changed from general anonymity tool to a tool tailored for very specific use.
Granted, this is probably what my understanding always should have been.
Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users
#4Traffic analysis is always a problem; this is a specific case, but I'm not sure this is anything new.
Many attacks on Tor are facilitated by or require JavaScript. Consider disabling it rather than executing arbitrary, untrusted software on your computer automatically.
Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users
#5does that captcha works without JavaScript?
The one they're describing does, yes.
Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users
#6I didn't realize just how fragile TOR is. . . While I understand that remaining anonymous requires adjusting your browser habits somewhat extensively, the fact that a ReCAPTCHA is enough to (theoretically) de-anonymize a user seems to me that it's not able to anonymize at all when browsing. While TOR may be useful for evading firewalls, my general perception of the project has changed from general anonymity tool to a…
If I were a national signals intelligence agency with a correspondingly huge multi-billion dollar budget, it would be trivial to run a large percentage of tor exit nodes... You could probably achieve it with 500 individual 1U servers colocated with random hosting companies around the globe at a budget of $250/mo * 500 = $125,000/mo, which is a tiny drop in the bucket compared to the traffic analysis capability it would give you, with the ability to capture all traffic entering/exiting each node's world-facing public ipv4/ipv6 interfaces.
edit: The major challenge would probably be continually violating various hosting companies' TOS/AUPs and getting service shut off, which would be a continual churn of provisioning new physical servers, shipping them to locations, arranging for plausibly deniable billing, etc.
Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users
#7One way around this is to disable javascript for ReCAPTCHA, the service provides you with a rather primitive HTML form with checkboxes over the images, generating only one request on submit.
Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users
#8I wonder why these anti-abuse systems don't use proof-of-work. Instead of a captcha, let the browser chug for 5 seconds, and then POST the solution in order to gain a temporary access cookie.
Sure, this could be attacked - but not at scale, and that's the whole point of the capchta anyway, right?
Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users
#9I wonder why these anti-abuse systems don't use proof-of-work. Instead of a captcha, let the browser chug for 5 seconds, and then POST the solution in order to gain a temporary access cookie. Sure, this could be attacked - but not at scale, and that's the whole point of the capchta anyway, right?
That requires JavaScript.
CloudFlare does have a JS-only challenge, which presumably does this type of thing, but this has a couple different problems. From a security perspective, you're executing arbitrary software, which is unwise, especially if you're looking for anonymity. The other issue is that the software is also proprietary.
https://support.cloudflare.com/hc/en-us/articles/204191238-W...
"During a JavaScript challenge you will be shown an interstitial page for about five seconds while CloudFlare performs a series of mathematical challenges to make sure it is a legitimate human visitor."
Related: I have started trying to get into contact with webmasters of sites that enable JS Challenges; my template is at the bottom of this page; it'd be great if others could do the same:
https://gitlab.com/mikegerwitz/dotfiles/blob/master/emacs.d/...
Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users
#10I didn't realize just how fragile TOR is. . . While I understand that remaining anonymous requires adjusting your browser habits somewhat extensively, the fact that a ReCAPTCHA is enough to (theoretically) de-anonymize a user seems to me that it's not able to anonymize at all when browsing. While TOR may be useful for evading firewalls, my general perception of the project has changed from general anonymity tool to a…
> I didn't realize just how fragile TOR is. . .
It's JavaScript that causes it (you could choose to disable it [0]). The FAQ [1] warns of it:
But there's a third issue: websites can easily determine whether you have allowed JavaScript for them, and if you disable JavaScript by default but then allow a few websites to run scripts (the way most people use NoScript), then your choice of whitelisted websites acts as a sort of cookie that makes you recognizable (and distinguishable), thus harming your anonymity.
...
Until we get there, feel free to leave JavaScript on or off depending on your security, anonymity, and usability priorities.
[0] https://www.torproject.org/docs/faq#DisableJS
[1] https://www.torproject.org/docs/faq#TBBJavaScriptEnabled