Slashdot Mirror
Tor Project Accuses CloudFlare of Mass Surveillance, Sabotaging Traffic (softpedia.com)
An anonymous reader writes: Tensions are rising between Tor Project administrators and CloudFlare, a CDN and DDoS mitigation service that's apparently making the life of Tor users a living hell. Tor administrators are saying that CloudFlare is making Tor users enter CAPTCHAs multiple times, tracking their Web sessions, and sharing data with other companies. Additionally, a study by some UK and US researchers found that are 1.3 million websites blocking access to Tor users, 3.67% being Alexa Top 1000 sites.
Although I am for an anonymous internet, all serious attempts to enter our systems have come from Russian, Chinese, Korean and Tor ips. And an ignorable part of traffic from those IPs is legitimate.
How do you stop Tor from being abusive?
The Cloudflare DDoS stuff is really annoying. You have to enable JavaScript (and it takes a few seconds) to load pages that would otherwise display fine w/ NoScript blocking just about everything. I'm at the point where I just close most pages that use it and treat them like clickbait crap on Facebook. Yeah, that headline sounds interesting but not worth the frustration and security risk.
I have my doubts that Cloudflare is doing this purposefully but what might be occurring is nefarious things occur on TOR and so a bad actor who happens to have their session exiting the same exit node as benign Tor users are setting off Cloudflare's security algorithms for all session exiting that node.
With Tor, I can specifically set which country I want my exit node to be from, and I have a large selection. If I want, I can select a single exit node and stick with it until the IP is blocked.
This is useful for scanning, brute forcing, exploitation, ex-filtrating data, or just trolling online. Anything nefarious that I don't want linked back to me easily. Malware using Tor for C&C traffic doesn't help the situation.
Bad actors give Tor a bad rap, even if does a ton of good for countries with repressive regimes. Thanks to negativity bias, people block Tor unless they have a specific reason for allowing it.
>> making the life of Tor users a living hell: enter CAPTCHAs multiple times, tracking their Web sessions, and sharing data with other companies
Are you sure they're not just anonymous SlashDot users?
In any case, you have an odd definition of a "living hell" even from a first-world perspective.
CloudFlare is not targeting Tor users. They aren't doing anything not considered best practices in general and practised all over the net. Showing a CAPTCHA to a Tor user is used in many places, including Google and Yahoo, who employ this method without irking people. The issue is that the technology CloudFlare is using to accomplish this is malfunctioning, and not that they are targeting Tor users.
So far, the Tor project hasn't accused them of surveillance publicly. That would be overkill. Adding a cookie to a web browsing session (which I presume is so that session is not subjected to such measures in the future) is hardly mass surveillance. Tor are being their usual anal selves and refusing to compromise. This problem is a technical malfunction, not mass surveillance of CloudFlare users.
They do have a point that CloudFlare can be notoriously difficult to resolve problems with, though. CloudFlare can be just as anal as Tor.
"Government is like fire; a handy servant, but a dangerous master." -- George Washington
It has to be able to blend in better, or it's not doing its job.
“He’s not deformed, he’s just drunk!”
And even if it doesn't, it manages to break the 'web in all sorts of interesting ways. Javascript really shouldn't be a basic requirement just to load a page, for one.
Aside: Math fail? 0.0367 * 1.3*10^6 = 47710, those don't all fit in the alexa top 1000, or it secretly isn't a top 1000.
I've been using Cloudflare for a few years, and they've helped me handle traffic and abuse from my one-server site and have never been a problem or expensive. Nor have they been malicious. I also have some Open Source projects like FreeDV.org going through Cloudflare.
One of the things they do is protect me from web attacks. It's an unfortunate fact that Tor really is used for web attacks.
Obviously, if there is a problem with their capcha, they need to fix it. I think it's perfectly fair for someone who is approaching the site through a known attack vector to have to pass a capcha once.
Regarding cookies, you're always going to get one on my site, whether you are using Tor or not, to support logins. HTTP isn't session-based and you need cookies to simulate sessions, so that you can have logins and dispense privileges where appropriate. One would expect that Tor users understand how to deal with cookies, and with less civil attempts to nail down their identity.
Bruce Perens.
Yeah - the exit nodes that the person is using is likely also being used for DDoS or some other attack.
"...a lone Anonymous Coward will find the courage to correct them! A hero will rise, and an Editor will fall. Things are about to get trollish on Slashdot, this year [and every year]. And this time, it's serious business!"
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
I, too, was wondering about that. 3.67% of 1000 is 36.7. What 0.7 of a web site?
"National Security is the chief cause of national insecurity." - Celine's First Law
.. What 0.7 of a web site?
Yahoo. That's what.
"If you want to improve, be content to be thought foolish and stupid." - Epictetus
...but it said "top 1000," so that's not it.
"National Security is the chief cause of national insecurity." - Celine's First Law
There are many script-kiddies who launch attacks using the TOR network so it isn't very surprising.
I rented a small server hosted by OVH that I used as a web proxy to make up for the poor peering of my ISP. I noticed the same thing : captcha, etc... That's because cheap servers like mine are popular for attackers and many are infected by botnets.
Yep. I use a VPN on one system and I am getting inundated with the CloudFlare CAPTCHAs, and they don't work right. It keeps coming up over and over.
Its not just TOR but also anyone using a VPN.
Sometimes I have to verify 3 times in sucession just to visit a single website only to find that there was not much on that site.
More and more sites are using Cloudflare and it's really annoying me and if they are tracking as well then bang goes you anomity, so your going to have to randomise agent strings with gibberish to try and fool the software from tracking
You mistakenly believe that they are targeting Tor directly, rather than indirectly. They don't download a list of these IPs, they have the list based on what IPs are being used in attacks. An unpublished exit node would have just as many attacks appearing to originate from it as a published exit node, and would make the blacklist in the exact same amount of time.
These are lists created by software, not lists input by humans. That is silly, there are actually lots of IPs that need blocking. Lots and lots. And lots. If they were being input by hand, there would be a whole major country employed in doing it. ;)
Sites that accept Tor connections find themselves subjected to many problems. Just one of them is being unable to identify the source of a connection to keep one person from setting up large numbers of accounts. This is happening on Voat, with a few certain users signing up hundreds of times then spamming the place -- while the rest of us are limited to one account per IP address. Got two people at your house who want accounts? Too fucking bad. Yet it does abs-olutely nothing to stop the Tor and proxy users. There is a very vocal contingent (I can't say how numerous they are) that insists that without the anonymity of Tor and proxies, they won't visit at all. These are not problem users, either, they're well-behaved. They might be spewing vile shit in /v/niggers or /v/FatPeopleHate, but they're not abusing the service and crossposting where nobody wants to see them. On the other hand, you have people like me, who want the crapfloods stopped. If it takes banning Tor and proxies, I'm afraid I have to say I'm for it -- though if it can be accomplished by less severe methods, that would be better. So far, management has taken the other side (doing nothing as best I can tell), so I've largely moved on. Rule #0 of any service should be "no unenforceable rules". If they can't or won't enforce the "one account per person" rule on Amalek and the Men's Rights Activists, then they shouldn't enforce them on anyone.
4chan, vile as it was, did not allow posting from proxies the last I checked (which would be over a year ago, now) because of the inability to stop the crapfloods. 8chan makes Tor users solve CAPTCHAs every three to five posts instead of once a day. There may actually be a good balance between preserving functionality for good Tor users while preventing abuse by the bad ones, but if a site as dedicated to free speech as Voat can't find it, then sites that aren't so gung ho about free speech are just going to say "screw it, block them". Can they really be blamed?
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.