Slashdot Mirror
CloudFlare Working On New System That Removes CAPTCHAs For Tor Users (softpedia.com)
Tor users have long criticized CloudFlare for annoying CAPTCHAs, but it appears the CDN provider is finally working on a fix. An anonymous reader writes: CloudFlare is working on a new system called "Challenge Bypass Specification," which it wants to deploy as a Tor Browser extension and replace the CAPTCHAs Tor users see when trying to access a website protected by CloudFlare. This new system will have users solve one CAPTCHA at the beginning and after that, the browser extension will use nonces (one-time authentication tokens) to prove the user's real identity before accessing a CloudFlare-protected site.
One time token per Tor user.... doesn't that mean it identifies the user??? Sounds anti-Tor.
If nothing else, this is just another confirmation that the modern web isn't set up to allow you to be anonymous.
That's a problem we techy types should be fixing, not encouraging solutions that identify the user even more.
, the browser extension will use nonces (one-time authentication tokens)
Couldn't they have come up with a better name one that doesn't evoke "Kiddy Fiddler"
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
The problem here is that the TOR browser does one separate circuit per domain. So if you visit site A through TOR and have to solve a captcha because of cloudflare, and then visit site B, your IP will be different, and you'll have to solve a captcha again. AFAIK this problem only surfaced (doing captchas for every cloudflare site) when TOR adopted that behaviour. Before, everything was routed through one circuit, and you only had to fill in one captcha.
Blinded. Token.
Learn some crypto and go read the proposal.
They also haven't read the source code for Tor or for Firefox or for the OS they're running all of it on. Package it with Tor and it's no worse than the rest of the TBB. In fact Cloudflare is trying to do it as an RFC so you could have multiple independent implementations.
If you'd read it, you'd have seen that they propose to use cryptographic blinding to prevent that. Which is the whole reason for having the extension in the first place.
What is it that they say about "a little knowledge"? There's sure a lot of that going on in this thread.
Two words: bullshit and trust.
Presentations of things and deliveries of them are not the same, especially if there is government interest. Call me a conspiracy theorist, I don't mind a bit, but I don't trust anything that's taken a hit (government seizing control of "Tor'ed" servers to pick prey) being different in the future, and that's just the tip of the iceberg; since someone did it, others have the idea that it's a great way to use it for that purpose.
Look, spammers don't follow RFC standards when they set up custom-coded SMTP servers to perform their work. That's the easiest and first example that pops right into my head. When encryption and specifics of encryption are introduced, it presents more of a psychological "challenge" to those who want to prove they can break it. In the process there can be more holes or bugs found, used, and/or tailored specially to try and work around it, hence producing more crap that can be seen and used as what appears to be perfectly valid or useful software/methods (see malware/viruses). I haven't even started thinking about the possibility in this context )(Tor; extension; either) of corporate use for luring people in to something that looks wonderful only to use it as a way to deliver more advertising or malware. Standards are awesome; in an environment where there are things that are a bit edgy or (in this case) have the possibility to have falsely-presented helpful features, there's just more that can be abused. I'm not focusing on things like Linux because it's a different context; it can be abused, too, or used as an abuse tool to the average, non-CS user. It's just not there yet. Different topic.
I think from all angles when I do something (or do my best). I see ad-blocking plugins for Firefox as an awesome thing that helps me having a better web experience, but I do not in any way believe that they are not/cannot be/ing used, potentially, for other purposes. If I want to sign into my email account via web, I use a virtual machine with an old version of Firefox, no plugins. Same goes for anything else with sensitive information that can be abused (SSN/DOB/Address/phone number/etc).
I've said way too much already. The first three paragraphs say what I intended to reply with as response to your differently-angled trust of standards and reading between the lines. I have had a life and childhood that lead me away from following standards, to see things from many angles. I'm not arguing with you at all, just stating fact from my experience, which you can accept or discard (your choice, of course) that as I have grown older, I have come to the realization that wherever there is a possibility for profit, theft, abuse, etc, there is going to be an individual, individuals, or groups finding ways to use the services/methods for evil when the services/methods were intended for good. I'll end with wherever there is a possibility for someone (government is the most repeated entity that tries to hide something and have it appear later; repeat; repeat) to use services/methods for the purpose of getting ahead of others in any way, or proving their self-worth for the purpose of presentation to others OR self-assurance, OR a combination or multiple combinations of both, the possibility subject item will become a research/experimentation/testing/use item.
In that case, you shouldn't trust Tor itself, since it relies on a terrific amount of equally complicated crypto and other code.
https://en.wikipedia.org/wiki/Nonce_(slang)
Figures. They are all child porn browsing nonces on tor anyway.
I read the article and the article says the system would be modular, so other edge providers could use it to distinguish between Tor Browser traffic (humans) and Tor scripts (automated bots). So a browser extension actually makes sense.
I wrote crypto implementations for 10 years
You are so full of shit.
It's bitztream, the autism-hating Slashdot troll!
Yeah, let's turn Tor Browser into swiss cheese by adding plug-ins from all sorts of characters. Fuck that and fuck CloudFlare.
And fuck you archive.is for once being a very usable site to now showing up as CloudFlare shit.
I guess once you become popular enough, you decide to alienate your users.
here's a plug to keep it open for us so you don't have to use hands.
I'm not especially inclined to bother with a site when Cloudflare shoves a captcha in my face not just to create and account or make a post; but to view its front page in the first place. My "One more step" is nearly always my browser's "back" button. Cloudflare can take their precious snowflake of a half-assed CDN and bite my shiny daffodil ass.
Imagine all the people...