Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare ReCAPTCHA De-Anonymizes Tor Users

cryptome.org

Post reply on HN
Print view View original

91–100 of 122 posts

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#91

Post by mmaunder »

djsumdog wrote: post #64
mmaunder wrote: post #55

"The Tor design doesn't try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out of the Tor network. That's because if you can see both flows, some simple statistics let you decide whether they match up." https://blog.torproject.org/blog/one-cell-enough Work on a client to try and mitigate the risk of timing attacks: https://news.ycombinator.com/ite…

I remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor. The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid. Source: http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...

Good opsec involves multiple layers of security. There's a fun talk at defcon next month on extending wifi range to avoid detection along with signal 'hiding' via SDR:

https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Gr...

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#92

Post by ayyn0n0n0 »

mmaunder wrote: post #91
djsumdog wrote: post #64

Earlier quoted context omitted.

I remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor. The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid. Source: http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...

Good opsec involves multiple layers of security. There's a fun talk at defcon next month on extending wifi range to avoid detection along with signal 'hiding' via SDR: https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Gr...

I will so be there!

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#93

Post by happyslobro »

subliminalbrad wrote: post #88
happyslobro wrote: post #35

Earlier quoted context omitted.

Yeah, this again. You can't secure your system, if you are running your adversary's code. Tor is upfront about this, this is why Javascript is disabled by default, and why there is a warning if you enable it globally. I suppose this does make for decent clickbait headlines though.

TorBrowser does not disable Javascript by default, and neither does TAILS.

It is shipped with the noscript plugin enabled, that part is pretty important. You aren't just referring to the fact that JS is disabled via a plugin, are you?

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#94

Post by hewhowhineth »

I stopped visiting sites with image recognition reCAPTCHAs. It has to be one of the worst UX patterns ever devised. It's dirt cheap to automate them away so it doesn't really stop any self-respecting bot maker, and it comes at a price of being a huge pain in the ass for a real user. Every time I run into them I felt used and abused.

It's really sad. So much brain power and this is what they come up with.

Apologies for the rant, couldn't help it. ReCAPTCHA is one of very few things I genuinely hate.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#96

Post by lucb1e »

jsmthrowaway wrote: post #86
lucb1e wrote: post #84

Earlier quoted context omitted.

For a bomb threat? Or more benignly, uploading a few documents to a whiteblowers platform (some news organizations have one)? No problem I'd say.

Have you tried TCP with 5sec latency? It can barely window. Shit, dialup was better, and that would still cost you half a second or so for a full-MTU packet. I see your point, don't worry, it would just be a lot more rough than you're implying, particularly to upload many heavy PDFs. (I kind of want to lab it now that we've discussed it.)

I meant a delay of a few seconds, not strictly >=5s, but still I wanted to prove you wrong even about 5 seconds.

Turns out Cloudflare deems 5 seconds latency too much. I thought most default timeouts were something like 30 seconds, and when writing applications myself I usually limit them to 8 or 10 seconds (to be able to get back to the user quick enough with an "unable to connect" error, but to also give it a moment). I expected that 5 seconds latency would be slow, but not unbearable. Instead it breaks stuff completely.

From my testing, 3.5 seconds latency works fine. Slow, but it consistently works.

Adding 5 seconds latency just breaks TLS connections to Cloudflare, though DNS, TCP and HTTP work. I was able to retrieve a webpage (via netcat) from my site, the redirect to HTTPS from http://news.ycombinator.com worked, and pinging showed a consistent 5030ms +/- 10ms latency.

Adding 3.5 to 5 seconds latency (random variance) makes, as expected, some connections fail. On my second try, I was able to load the Hacker News homepage, consisting of: 1) the homepage; 2) robots.txt (wget retrieves this); 3) css file; 4) javascript file; 5) favicon; 6-10) 4 images. In total 10 resources, taking a minute and 20 seconds. After establishing a TLS connection, it could reuse that connection for multiple requests. I think this is equivalent to hitting reload a few times in a browser.

So VPN-TOR-VPN might work still, though it is indeed more on the edge than I expected. Thanks for making me venture here, I learned something!

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#97

Post by Relys »

ayyn0n0n0 wrote: post #92
mmaunder wrote: post #91

Earlier quoted context omitted.

Good opsec involves multiple layers of security. There's a fun talk at defcon next month on extending wifi range to avoid detection along with signal 'hiding' via SDR: https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Gr...

I will so be there!

Same! =D

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#98

Post by Grollicus »

Johnny555 wrote: post #47

Why is this phrased as if it's Cloudflare's fault? If it's this easy for a side effect of a recapcha image to de-anonymize a Tor user, then this seems like a failing of the Tor protocol that they should fix. Maybe they need to introduce more jitter, repackage requests into a single stream with consistent (or randomized) packet size, or pad the packets with random data.

It is reCAPTCHA's fault. (kind of, I mean its just the way its built)

Still, if you browse the web via Tor you will see reCAPTCHAs everywhere because of Cloudflare. And that IS Cloudflare's fault, and its really annoying which is propably why this article is phrased this way.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#99

Post by sitkack »

tedunangst wrote: post #26
jgrahamc wrote: post #13

This short piece doesn't have much detail. But if reCAPTCHA is usable to deanonymize Tor users then I would like to know about it in detail so I can do something about it.

I didn't see anything that makes it unique to recaptcha. Any fingerprint able traffic pattern that can be observed coming and going will work. I could make a website that adds random(1, 64) one pixel images to each page. As you browse the site, you'll be broadcasting 6 bits of identifier with every click.

The problem is that traffic is passed all the way through the network. A solution would be to have a transformative proxy on the inside of the tor network running as a hidden service that made requests on your behalf. Then it could possibly respond with .har files or some other transformed asset that doesn't match the same traffic signature. VPN into Tor, terminate at a high level proxy and then exit Tor through this intermediary.

Re: Cloudflare ReCAPTCHA De-Anonymizes Tor Users

#100

Post by _asummers »

mmaunder wrote: post #91
djsumdog wrote: post #64

Earlier quoted context omitted.

I remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor. The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid. Source: http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...

Good opsec involves multiple layers of security. There's a fun talk at defcon next month on extending wifi range to avoid detection along with signal 'hiding' via SDR: https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Gr...

There's another good talk on more general opsec from Defcon a few years ago called "Don't fuck it up".

https://youtube.com/watch?v=J1q4Ir2J8P8

Post reply on HN