Slashdot Mirror
Tor Project Accuses CloudFlare of Mass Surveillance, Sabotaging Traffic (softpedia.com)
An anonymous reader writes: Tensions are rising between Tor Project administrators and CloudFlare, a CDN and DDoS mitigation service that's apparently making the life of Tor users a living hell. Tor administrators are saying that CloudFlare is making Tor users enter CAPTCHAs multiple times, tracking their Web sessions, and sharing data with other companies. Additionally, a study by some UK and US researchers found that are 1.3 million websites blocking access to Tor users, 3.67% being Alexa Top 1000 sites.
I thought it was just me that had to do the captchas more than once.
Although I am for an anonymous internet, all serious attempts to enter our systems have come from Russian, Chinese, Korean and Tor ips. And an ignorable part of traffic from those IPs is legitimate.
How do you stop Tor from being abusive?
The Cloudflare DDoS stuff is really annoying. You have to enable JavaScript (and it takes a few seconds) to load pages that would otherwise display fine w/ NoScript blocking just about everything. I'm at the point where I just close most pages that use it and treat them like clickbait crap on Facebook. Yeah, that headline sounds interesting but not worth the frustration and security risk.
Modern app appers know that ONLY apps can app apps, not LUDDITE TOR! If these LUDDITES switched to appy app apps instead of LUDDITE TOR, they would get modern APPtchas instead of LUDDITE captchas!
Apps!
I have my doubts that Cloudflare is doing this purposefully but what might be occurring is nefarious things occur on TOR and so a bad actor who happens to have their session exiting the same exit node as benign Tor users are setting off Cloudflare's security algorithms for all session exiting that node.
With Tor, I can specifically set which country I want my exit node to be from, and I have a large selection. If I want, I can select a single exit node and stick with it until the IP is blocked.
This is useful for scanning, brute forcing, exploitation, ex-filtrating data, or just trolling online. Anything nefarious that I don't want linked back to me easily. Malware using Tor for C&C traffic doesn't help the situation.
Bad actors give Tor a bad rap, even if does a ton of good for countries with repressive regimes. Thanks to negativity bias, people block Tor unless they have a specific reason for allowing it.
You get used to it.
Captcha: Onion
Captcha: Traffic Sense
Captcha: JohTn89 uBs
Captcha: 910
I'm not a robot:
Selected 4 street name signs
Selected 3 bodies of water
Selected 3 panels with road signs
and finally
Slashdot captcha: chanted
this is a rockerfeller company..
>> making the life of Tor users a living hell: enter CAPTCHAs multiple times, tracking their Web sessions, and sharing data with other companies
Are you sure they're not just anonymous SlashDot users?
In any case, you have an odd definition of a "living hell" even from a first-world perspective.
3.67% of 1000 is 36.7 websites. I question whoever came up with those stats.
Additionally, a study by some UK and US researchers found that are 1.3 million websites blocking access to Tor users, 3.67% being Alexa Top 1000 sites
This sentence doesn't make any sense. 3.67% of 1.3 million would be ~47700 sites. Good ole timmay who is unable to actually edit anything since the actual article says:
The researchers found that over 1.3 million websites actively block connections from the Tor network, including 3.67% of the top-1,000 Alexa sites.
which makes much more sense.
Allow 4 hop circuits with exit nodes that DO NOT publish their IP.
Entry-Middle-Middle-NoPublishExit.
Then cloudfare won't know it's a Tor node so easily.
CloudFlare is not targeting Tor users. They aren't doing anything not considered best practices in general and practised all over the net. Showing a CAPTCHA to a Tor user is used in many places, including Google and Yahoo, who employ this method without irking people. The issue is that the technology CloudFlare is using to accomplish this is malfunctioning, and not that they are targeting Tor users.
So far, the Tor project hasn't accused them of surveillance publicly. That would be overkill. Adding a cookie to a web browsing session (which I presume is so that session is not subjected to such measures in the future) is hardly mass surveillance. Tor are being their usual anal selves and refusing to compromise. This problem is a technical malfunction, not mass surveillance of CloudFlare users.
They do have a point that CloudFlare can be notoriously difficult to resolve problems with, though. CloudFlare can be just as anal as Tor.
"Government is like fire; a handy servant, but a dangerous master." -- George Washington
Our newly acclaimed champion of encryption also blocks TOR traffic, at least these ones:
https://getsupport.apple.com/
https://support.apple.com/
https://discussions.apple.com/
Source: TOR Project
It has to be able to blend in better, or it's not doing its job.
“He’s not deformed, he’s just drunk!”
They aren't doing anything not considered best practices in general and practised all over the net. Showing a CAPTCHA to a Tor user is used in many places, including Google and Yahoo, who employ this method without irking people.
Speak for yourself. Using google is certainly very annoying with TOR.
Not any more than any ad and analytics shit is mass surveillance ... you know, tracking people on a large scale.
You're right, it likely has nothing specific to do with Tor, but let's not pretend the assholes who are tacking everybody on the internet aren't essentially doing mass surveillance.
Lost at C:>. Found at C.
So what if CloudFlare is carrying out surveillance, isnt Tor supposed to be immune to that? No one granted Tor users the unmitigated right to browse the internet and be treated the same as everyone else, especially if they can be picked out from the crowd...
I've been using Cloudflare for a few years, and they've helped me handle traffic and abuse from my one-server site and have never been a problem or expensive. Nor have they been malicious. I also have some Open Source projects like FreeDV.org going through Cloudflare.
One of the things they do is protect me from web attacks. It's an unfortunate fact that Tor really is used for web attacks.
Obviously, if there is a problem with their capcha, they need to fix it. I think it's perfectly fair for someone who is approaching the site through a known attack vector to have to pass a capcha once.
Regarding cookies, you're always going to get one on my site, whether you are using Tor or not, to support logins. HTTP isn't session-based and you need cookies to simulate sessions, so that you can have logins and dispense privileges where appropriate. One would expect that Tor users understand how to deal with cookies, and with less civil attempts to nail down their identity.
Bruce Perens.
Not any more than any ad and analytics shit is mass surveillance ... you know, tracking people on a large scale.
You're right, it likely has nothing specific to do with Tor, but let's not pretend the assholes who are tacking everybody on the internet aren't essentially doing mass surveillance.
It worth remembering that these "assholes" are not going around hacking websites and forcing their tags onto them, website owners are adding third party tracking websites and ad networks to their site to cover the cost of running a website. Instead of bitching about ad networks, just stop using ad supported sites.
Running a website costs money, like everything else in this world.
I dont read
They also do this to VPN services.
There are many script-kiddies who launch attacks using the TOR network so it isn't very surprising.
I rented a small server hosted by OVH that I used as a web proxy to make up for the poor peering of my ISP. I noticed the same thing : captcha, etc... That's because cheap servers like mine are popular for attackers and many are infected by botnets.
Wikipedia, they stopped me improving the content when I switched completely to Tor browsing. So Wikipedia bugs are no longer a problem of mine.
The analysis needs to become more sophisticated. Judging a user by their ip address is the internet version of "driving while black" or "flying while muslim." It is super easy to do, but gives you tons and tons of false positives.
You can choose between doing it the easy way and alienating all those legitimate users (the number of which is probably growing considering people's inherent desire to not be surveilled) or you can start analyzing what they do on the site and banning them based on their actions.
Craigslist is starting to move in that direction - they still ban by ip address but (1) the ban is only short term and (2) it doesn't kick in until a user on that ip address has done something suspicious like read 50 ads in 50 seconds. It would be great if they stepped it up so that if you had a cookie that was not associated with anything suspicious you would not be banned despite the ip address. That would require some sort of continuous score-keeping such that the first couple of accesses might be throttled until the user has "earned" trust in order to prevent malicious actors from simply discarding cookies associated with bad behaviour. The complexities of these algorithms are beyond the scope of a slashdot post though.
Is it still a "malfunction" if some percent of Tor users are in fact treating the hosts they connect to with mal-intent? And what if frequent captchas are believed to reduce specific forms of malicious behavior?
It may simply be a feature that is unpopular with some small subset of users.
is was shit
Seriously, if you read the comment threads where this is happening, you have ioerror doing stuff like choosing words with obvious nasty connotations to describe what Cloudflare is doing, then coming up with obvious bullshit "but I just mean it's technically X" defenses when called on it. Not to mention refusing to acknowledge the obvious relevance of the well-known fact that traffic from Tor exits has a far higher abuse probability than other traffic.
Either he's too dumb to adjust his rhetoric to his audience and purposes, or he's too arrogant and emotional to care about the actual effects of what he says.
If the Tor project wants to work with anybody in Cloudflare's position to actually solve anything, they need to get this guy out of the conversation.
Sites that accept Tor connections find themselves subjected to many problems. Just one of them is being unable to identify the source of a connection to keep one person from setting up large numbers of accounts. This is happening on Voat, with a few certain users signing up hundreds of times then spamming the place -- while the rest of us are limited to one account per IP address. Got two people at your house who want accounts? Too fucking bad. Yet it does abs-olutely nothing to stop the Tor and proxy users. There is a very vocal contingent (I can't say how numerous they are) that insists that without the anonymity of Tor and proxies, they won't visit at all. These are not problem users, either, they're well-behaved. They might be spewing vile shit in /v/niggers or /v/FatPeopleHate, but they're not abusing the service and crossposting where nobody wants to see them. On the other hand, you have people like me, who want the crapfloods stopped. If it takes banning Tor and proxies, I'm afraid I have to say I'm for it -- though if it can be accomplished by less severe methods, that would be better. So far, management has taken the other side (doing nothing as best I can tell), so I've largely moved on. Rule #0 of any service should be "no unenforceable rules". If they can't or won't enforce the "one account per person" rule on Amalek and the Men's Rights Activists, then they shouldn't enforce them on anyone.
4chan, vile as it was, did not allow posting from proxies the last I checked (which would be over a year ago, now) because of the inability to stop the crapfloods. 8chan makes Tor users solve CAPTCHAs every three to five posts instead of once a day. There may actually be a good balance between preserving functionality for good Tor users while preventing abuse by the bad ones, but if a site as dedicated to free speech as Voat can't find it, then sites that aren't so gung ho about free speech are just going to say "screw it, block them". Can they really be blamed?
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
I whitelist cookies and javascript as needed (my whitelist is very very short really).
And I just now was asked to "Please complete the security check to access alpha.wallhaven.cc" when trying to go to http://alpha.wallhaven.cc/wall....
Fuck em. You don't want me to look at your site. Then I simply don't. I don't give a shit.
A fucking "security check" to look at some desktop wallpapers??!!?? For crying out loud!!
The Open Internet is indeed getting smaller and smaller by the day.
Im stuck using Propel (a relic of dial-up) on my internet connection and I regularly get intercepted by Cloudfire, shopping cart subsystems, and other third-party apps thinking im trying to do something nefarious.
Heaven help you if your browsing in a non-linear fashion (control-click) with multiple tabs set to load in the background while your browsing.
I usually just give up and look somewhere else.