CloudFlare Working On New System That Removes CAPTCHAs For Tor Users (softpedia.com)

Tor users have long criticized CloudFlare for annoying CAPTCHAs, but it appears the CDN provider is finally working on a fix. An anonymous reader writes: CloudFlare is working on a new system called "Challenge Bypass Specification," which it wants to deploy as a Tor Browser extension and replace the CAPTCHAs Tor users see when trying to access a website protected by CloudFlare. This new system will have users solve one CAPTCHA at the beginning and after that, the browser extension will use nonces (one-time authentication tokens) to prove the user's real identity before accessing a CloudFlare-protected site.

Comments

Identifying the user??

[Anonymous Coward]

One time token per Tor user.... doesn't that mean it identifies the user??? Sounds anti-Tor.

Re:Identifying the user??

[omnichad]

This is nothing that can't be done with any old cookie. In fact, it probably uses them. If anything, this highlights some inherent problems with using Tor without being careful.

Re:Identifying the user??

[Anonymous Coward]

One-time token per site, not user.

Re:Identifying the user??

[kav2k]

To be specific, let me quote the spec:

The current Cloudflare CAPTCHA simply places a cookie allowing you to access the website. Since Cloudflare controls the origins, it could currently correlate user sessions across multiple circuits using these cookies. This is a gap in the Tor Browser threat model- the design explicitly ignores linking within a session by malicious first parties, but Cloudflare has effectively first-party control over a large proportion of the web.

Our design is an improvement over this state of affairs. Since the CAPTCHA service only sees blinded nonces, Cloudflare cannot link a CAPTCHA solution session to a given redemption request. Since each token is used only once, in contrast to a cookie, the tokens themselves cannot be used to link requests.

Re: Identifying the user??

[Anonymous Coward]

Aka a cookie? So why the need for a browser extension?

NSL to CloudFlare and data slurp commencing in 5... 4... 3...

Re:Identifying the user??

[sittingnut]

one should always be careful using anything, as sjw infested, as western intelligence infested, and as quick to jump to convictions without proof or crime, as tor now is.

Re: Identifying the user??

[Hizonner]

Aka a cookie? So why the need for a browser extension?

Because it wants to blind the token.

NSL to CloudFlare and data slurp commencing in 5... 4... 3...

NSLs don't work that way. Even the DOJ doesn't claim they can do that with an NSL.

There is, of course, a risk in running any code. But in this case one assumes they'll publish the code.

Re:Identifying the user??

[omnichad]

In other words, they could have just used a cookie. But instead, they're making their own cookie system because they don't think Tor should even have cookies. This is good.

I just hope they contribute it to the Tor standard and release the plugin unbranded rather than just as a "Cloudflare enabler."

Re:Identifying the user??

[gweihir]

It is user-tracking, sure. Anonymous user-tracking though. And if it works per-session, it is an acceptable solution IMO, as you can just restart the Tor-browser before going to a different site. Not great, but a lot better than nothing.

Re:Identifying the user??

[gweihir]

I agree. I think they are making an honest and competent attempt to solve the issue for Tor and that is excellent news.

Thanks for the link!

Re:Identifying the user??

[networkBoy]

you can still correlate those nonces, yes?
Solve Capcha get nonce
use nonce at site A
use nonce at site B
use nonce at site C

At site A you divulge the nonce and component 1 of your identity
at site B you divulge the nonce and component 2 of your identity
at site C you divulge the nonce and component 3 of your identity
across sites A:C you divulge a larger set of your writing style than at only one by its self.

Third party actor (not cloudflare) can use this to build your session info into an ID of you; assuming they already have a large data trove on you, then the smaller bits they captured from the nonce can be used to correlate this TOR session with your existing dataset.

just sayin...

Re:Identifying the user??

[networkBoy]

or, just don't install the extension.

Re:Identifying the user??

[gweihir]

Indeed.

Re:Identifying the user??

[omnichad]

From Wikipedia:

In cryptography, a nonce is an arbitrary number that may only be used once

You're given multiple nonces for solving one CAPTCHA.

Re:Identifying the user??

[Shane_Optima]

It's the best that can be hoped for. I'm shocked they cared at all. People who're that worried shouldn't be using exit nodes at all without a post-Tor VPN hop. Costs perhaps $3 per month, payable by gift cards. Bypasses this issue entirely and also puts a much needed layer between you and the exit node.

Half of the people who're paranoid about this sort of thing don't even bother to use Whonix, which (with a snapshot on VB, or after they fix it to be a proper DispVM on Qubes) doesn't force you have to micromanage anything at all for the best* possible tracking protection between sessions. The easiest to use option is also not uncommonly the most secure, but some people just have to be unreasonably fancy about everything.


* Ignoring traffic analysis, which is a very... specific vector and on a low latency system will always be losing battle anyway.

Re:Identifying the user??

[Anonymous Coward]

"Cloudflare cannot link a CAPTCHA solution session to a given redemption request"? Surely the "nonces" can contain any amount of information they wish. Don't they mean "does not link"?

Tracking

[BitZtream]

So in the end ... you can easily track Tor users ...

Oh, and this doesn't do jack shit to stop bots ... a user can authenticate one bot manually by viewing the captcha ... then letting it run for hours, so theres a startup cost, but after that ... its back to bot town.

And how do you get users to do captchas for you? Something like the URL in my sig, which uses a 'game' to get users to do actual work no wants to pay for.

Re:Tracking

[Hizonner]

Blinded. Token.

Learn some crypto and go read the proposal.

Re:Tracking

[BitZtream]

I wrote crypto implementations for 10 years, have a software package certified as FIPS 140-2 written entirely by me (reviewed of course by a certification facility), and I read the proposal.

Having done crypto in the real world for those years, I know the difference between proposed implementation and actual implementation, just like the guys at OpenSSL ... remember heart bleed? You think that was because those guys didn't know crypto ... or because of a bad implementation or bug?

Re:Tracking

[Hizonner]

In that case, you shouldn't trust Tor itself, since it relies on a terrific amount of equally complicated crypto and other code.

Re:Tracking

[Anonymous Coward]

I wrote crypto implementations for 10 years

You are so full of shit.

Re:Tracking

[Anonymous Coward]

It's bitztream, the autism-hating Slashdot troll!

Tor.

[ledow]

If nothing else, this is just another confirmation that the modern web isn't set up to allow you to be anonymous.

That's a problem we techy types should be fixing, not encouraging solutions that identify the user even more.

Re:Tor.

[Calydor]

Problem: Easy anonymous access for legitimate users allows easy anonymous access for malicious users.

Solution: ?

The problem isn't necessarily technical so much as it is psychological. To quote one of the Batman movies, some people just want to watch the world burn.

Re:Tor.

[Anonymous Coward]

no. it is just further confirmation that CLOUDFARE isn't set up to allow you to be anonymous. they don't WANT that, because they track the shit out of users on the sites they service... they're as bad, if not worse, than any third party ad network.

and there's no fucking way an extension with 1 time 'authentication' is 'anonymous' or untrackable.

Re:Tor.

[110010001000]

It has nothing to do with the web specifically. NETWORKING is not anonymous. Networks were designed to share information. In order to share information you need to know the endpoints on the network in order to route the data to them. This is really unpopular, but there is NO WAY to make a network anonymous. Tor isn't anonymous, the exit nodes need to know where the endpoints are.

Re:Tor.

[Hizonner]

Read what they propose. You may have to learn some math first.

Re:Tor.

[omnichad]

I posted the same at first, but it looks like they avoided the low-hanging fruit. They could have just used cookies - which tor browsers accept just the same as any web page. They're actually proposing a more anonymous standard, and trying to close the cookie security hole.

Re:Tor.

[Anonymous Coward]

Much like "humans will always (ALWAYS) be able to kill each other in large numbers" I think "humans will always be able to act anonymously" is something you can only thin, and you're treating a symptom at best.

Then again, the psychological root is probably not fully soluble either. It does seem a better place to preempt malice though, particularly compared to After The Matter.

Re:Tor.

[driblio]

Do you have any idea how tor works? The exit nodes specifically don't know where the end points are, you need ISP/NSA level monitoring to correlate flows.

Re:Tor.

[AmiMoJo]

They mean that the browser will be able to generate one time codes for each web site, not use the same code multiple times.

https://github.com/cloudflare/...

"In this document we detail a protocol that enables a user to complete
      a single edge-served challenge page in return for a finite number of
      signed tokens. These tokens can then be used to bypass future
      challenge pages that are served by participating edge-providers. The
      tokens are generated in such a way that signed tokens cannot be
      linked to future redeemed tokens for bypassing."

Re:Tor.

[110010001000]

Um, no. Do YOU have any idea? How would the exit nodes know where to send the data to if it didn't know the true IP of the end point? Jesus. If you own the exit node you know where the flows are going.

Re:Tor.

[ADRA]

People who benefit from anonymity:
  - Political Radicals
  - Privacy Averse (Really, there aren't many that care, and you aren't changing their minds fast enough)
  - Trolls / Illegal Activity / blah blah

People who benefit from identity:
  - Soft hearted hate-troll haters
  - Oppressive and not-so oppressive governments (and their law enforcement)
  - Pretty much every notable web company making money off your info/reputation

People that don't give a fuck:
  - Everyone else

Re:Tor.

[ledow]

First category could include:

- Rape victims seeking advice online.
- People who are being stalked by their ex, or eye-witnesses to crimes, who might have someone kill them if they find them (sure, they could live their entire life offline in perpetuity, but that's just as oppresive)
- Political dissidents
- People who publish honest things about oppressive regimes (e.g. Salman Rushdie)
- You, writing this post, hoping that your employer doesn't find that story about him being a shithead last month.
- Some guy in China / Korea wondering what all this democracy shit is about and why it's blocked.

All kinds of decent reasons for anonymity.
Very few for identity for just casual browsing. Sure, buying products, paying for services, these things come with identity attached in one way or another (even Bitcoin could catch up with you years later if someone bothers to track the blockchain transactions). But general web browsing? Nah.

And the companies making money from your data are, basically not. They're making money from other people who pay to show you ads. A slightly better rate can be had using data, but Google et al all have opt-outs which turn the ads into generic bollocks rather than anything to do with your life, profession, shopping habits, etc. As such, data for that isn't **necessary**.

Anonymity has a million reasons for and very little against.

Oh, no, a terrorist used an anonymous means of warning us about the bomb! Like a phone call from a throwaway phone, or a message sent from a cyber-cafe, or posting a clean piece of paper to a police station.

Taking away anonymity on the net doesn't "solve" any problem. It might shift it to other media for a while. But solving the need for identity is a solution which solves a lot of problems.

P.S. Don't use Tor. Opt-out of ads but don't really care about Google. Far from privacy-paranoid. Just understand the need for it.

Re:Tor.

[Anonymous Coward]

But not where they're coming from. Hence, the anonymity (assuming nothing else leaks that info).

Your assertion that a network cannot be anonymous is incorrect. Onion routing is a technique for anonymous communication over a computer network....

This is really unpopular, but there is NO WAY to make a network anonymous.

It's "really unpopular" because it's wrong.

Re:Tor.

[driblio]

Yes, I do. Exit nodes know where the next hop is, obviously, but not the end point.

Calm down, climb down, and admit you were wrong.

Nonces?

[Big Hairy Ian]

, the browser extension will use nonces (one-time authentication tokens)

Couldn't they have come up with a better name one that doesn't evoke "Kiddy Fiddler"

Re:Nonces?

[Anonymous Coward]

nonces is short for "N" once

It means you use the number one time.

You are the only person who is has these "Kiddy Fiddler" feelings evoke. Perhaps you should have a seat over there and have a talk with Chris Hansen.

Re:Nonces?

[Anonymous Coward]

Nonce is a British slang for a sexual predator.
https://en.wikipedia.org/wiki/...
http://www.urbandictionary.com...

Re:Nonces?

[Hizonner]

Actually, "nonce" is a longstanding English word meaning a single specific moment. It survives in common usage in the phrase "for the nonce".

Re:Nonces?

[omnichad]

This is a technology site. Regardless of any UK slang most Slashdotters have never heard of, a nonce is a very standard word in the world of security/cryptography.

Re:Nonces?

[Anonymous Coward]

That's nice, it's also a standard term in cryptography and has been for a very, very long time.

Re:Nonces?

[Anonymous Coward]

I was going to remark pessimistically about the fascinations of Normals keeping us one-foward-two-back as usual, but urbandictionary may actually be a notch further below them.

Like hell I'm going to let makeupwords.com get in the way.

Re:Nonces?

[clickclickdrone]

You are the only person who is has these "Kiddy Fiddler" feelings evoke.

No, me too. It's a common phrase in the UK to describe pedos.

One connection per domain problem

[NotInHere]

The problem here is that the TOR browser does one separate circuit per domain. So if you visit site A through TOR and have to solve a captcha because of cloudflare, and then visit site B, your IP will be different, and you'll have to solve a captcha again. AFAIK this problem only surfaced (doing captchas for every cloudflare site) when TOR adopted that behaviour. Before, everything was routed through one circuit, and you only had to fill in one captcha.

Re:One connection per domain problem

[omnichad]

You just load the Javascript for the CAPTCHA all from the same Cloudflare domain, and it gets a third-party cookie that identifies you everywhere.

What they actually did was implement a standard and a browser extension that improves on the security of third-party cookies, and are effectively encouraging them to be completely disabled within Tor.

Ok, guilty.

[poofmeisterp]

Read subject of comment ^^

I'm guilty of not reading the article. I don't have to because in the summary I see "a Tor Browser extension" and stopped.

What the eff? That completely defeats the purpose of having something that's not "trackable". It could very well be an extension that phones home the activity of the user to a government entity so they can catch more of the REALLY bad guys - that being whatever's on the menu of good catch this week/month/whatever. If it were open source, it's still BS because you KNOW most people that use Tor aren't developers and aren't going to set up an environment to compile an extension to ensure every line of it is clean. Let alone what it sends to CAPTCHA to work around the problem; doing so can be used to easily identify who is using Tor to make them a target rather than the exit nodes or whatever they're called now.

Re:Ok, guilty.

[Hizonner]

If it were open source, it's still BS because you KNOW most people that use Tor aren't developers and aren't going to set up an environment to compile an extension to ensure every line of it is clean.

They also haven't read the source code for Tor or for Firefox or for the OS they're running all of it on. Package it with Tor and it's no worse than the rest of the TBB. In fact Cloudflare is trying to do it as an RFC so you could have multiple independent implementations.

Let alone what it sends to CAPTCHA to work around the problem; doing so can be used to easily identify who is using Tor to make them a target rather than the exit nodes or whatever they're called now.

If you'd read it, you'd have seen that they propose to use cryptographic blinding to prevent that. Which is the whole reason for having the extension in the first place.

What is it that they say about "a little knowledge"? There's sure a lot of that going on in this thread.

Re:Ok, guilty.

[poofmeisterp]

Two words: bullshit and trust.

Presentations of things and deliveries of them are not the same, especially if there is government interest. Call me a conspiracy theorist, I don't mind a bit, but I don't trust anything that's taken a hit (government seizing control of "Tor'ed" servers to pick prey) being different in the future, and that's just the tip of the iceberg; since someone did it, others have the idea that it's a great way to use it for that purpose.

Look, spammers don't follow RFC standards when they set up custom-coded SMTP servers to perform their work. That's the easiest and first example that pops right into my head. When encryption and specifics of encryption are introduced, it presents more of a psychological "challenge" to those who want to prove they can break it. In the process there can be more holes or bugs found, used, and/or tailored specially to try and work around it, hence producing more crap that can be seen and used as what appears to be perfectly valid or useful software/methods (see malware/viruses). I haven't even started thinking about the possibility in this context )(Tor; extension; either) of corporate use for luring people in to something that looks wonderful only to use it as a way to deliver more advertising or malware. Standards are awesome; in an environment where there are things that are a bit edgy or (in this case) have the possibility to have falsely-presented helpful features, there's just more that can be abused. I'm not focusing on things like Linux because it's a different context; it can be abused, too, or used as an abuse tool to the average, non-CS user. It's just not there yet. Different topic.

I think from all angles when I do something (or do my best). I see ad-blocking plugins for Firefox as an awesome thing that helps me having a better web experience, but I do not in any way believe that they are not/cannot be/ing used, potentially, for other purposes. If I want to sign into my email account via web, I use a virtual machine with an old version of Firefox, no plugins. Same goes for anything else with sensitive information that can be abused (SSN/DOB/Address/phone number/etc).

I've said way too much already. The first three paragraphs say what I intended to reply with as response to your differently-angled trust of standards and reading between the lines. I have had a life and childhood that lead me away from following standards, to see things from many angles. I'm not arguing with you at all, just stating fact from my experience, which you can accept or discard (your choice, of course) that as I have grown older, I have come to the realization that wherever there is a possibility for profit, theft, abuse, etc, there is going to be an individual, individuals, or groups finding ways to use the services/methods for evil when the services/methods were intended for good. I'll end with wherever there is a possibility for someone (government is the most repeated entity that tries to hide something and have it appear later; repeat; repeat) to use services/methods for the purpose of getting ahead of others in any way, or proving their self-worth for the purpose of presentation to others OR self-assurance, OR a combination or multiple combinations of both, the possibility subject item will become a research/experimentation/testing/use item.

Re:Ok, guilty.

[Anonymous Coward]

I read the article and the article says the system would be modular, so other edge providers could use it to distinguish between Tor Browser traffic (humans) and Tor scripts (automated bots). So a browser extension actually makes sense.

Nonces... LOL

[Anonymous Coward]

https://en.wikipedia.org/wiki/Nonce_(slang)

Figures. They are all child porn browsing nonces on tor anyway.

Fuck This

[Anonymous Coward]

Yeah, let's turn Tor Browser into swiss cheese by adding plug-ins from all sorts of characters. Fuck that and fuck CloudFlare.

And fuck you archive.is for once being a very usable site to now showing up as CloudFlare shit.

I guess once you become popular enough, you decide to alienate your users.

If you like being fucked up the ass

[Anonymous Coward]

here's a plug to keep it open for us so you don't have to use hands.

Or, just skip those sites.

[SvnLyrBrto]

I'm not especially inclined to bother with a site when Cloudflare shoves a captcha in my face not just to create and account or make a post; but to view its front page in the first place. My "One more step" is nearly always my browser's "back" button. Cloudflare can take their precious snowflake of a half-assed CDN and bite my shiny daffodil ass.