Slashdot Mirror
Cloudflare Ends CAPTCHAs For Tor Users (zdnet.com)
Cloudflare announced on Monday a new service named the "Cloudflare Onion Service" that can distinguish between bots and legitimate Tor traffic. The main advantage of this new service is, said Cloudflare, that Tor users will see far less, or even no CAPTCHAs when accessing a Cloudflare-protected website via the Tor Browser. A reader writes: The new Cloudflare Onion Service needed the Tor team to make "a small tweak in the Tor binary," hence it will only work with recent versions of the Tor Browser -- the Tor Browser 8.0 and the new Tor Browser for Android, both launched earlier this month. Tor users have been complaining about seeing too many CAPTCHAs when accessing a Cloudflare-protect site for years now. In February 2016, Tor Project administrators went as far as to accuse Cloudflare of "sabotaging Tor traffic" by forcing Tor users to solve CAPTCHA fields ten times or more, in some cases.
Cloudflare responded to accusations a month later, claiming the company was only showing CAPTCHAs because 94 percent of all Tor traffic was either automated bots or originating from malicious actors. Half a year later, in October 2016, Cloudflare started looking into methods of removing CAPTCHAS for Tor users. Their first foray was the Challenge Bypass Specification and a Tor Browser extension, but that project didn't go too far, and has been eventually replaced by the new Cloudflare Onion Service today.
Cloudflare responded to accusations a month later, claiming the company was only showing CAPTCHAs because 94 percent of all Tor traffic was either automated bots or originating from malicious actors. Half a year later, in October 2016, Cloudflare started looking into methods of removing CAPTCHAS for Tor users. Their first foray was the Challenge Bypass Specification and a Tor Browser extension, but that project didn't go too far, and has been eventually replaced by the new Cloudflare Onion Service today.
You solve more than a few per day and then you're stuck in a validation loop that asks you to complete CAPTCHAs over and over again, never accepting that you are human.
#DeleteFacebook
Does anyone actually believe Tor is secure?
Cloudflare are ideologically driven internet censors.
You don't think this same technology is going to be used to track and report dissidents to the "new world order"?
They told us that we were being MiTM'd. Without them it's now more difficult to know.
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
CAPTCHA is just a test to distinguish between bots and humans. CAPTCHA does not need to be images of swirled words. It sounds like Cloudfare has developed a CAPTCHA which isn't even visible to the end user (yeah!).
there was a CAPTCHA that prevented me from logging in and placing my order. How stupid is that?
Some online stores require passing a CAPTCHA if they sell products that have a vibrant secondary market. Making automated mass buying harder for scalpers ostensibly helps get products in front of bona fide end users. One example is Ticketmaster, as ticket scalping increases cost for people attending a show without benefiting the performers. Another is Humble Store, as a warez group might have a bot watch the site for new releases, pay the minimum, and send the DRM-free games straight to the topsites.
TOR traffic can be identified by the way it looks, not by the source it comes from? Interesting...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I had to stop using cloudflare dns because some web sites wouldn't resolve. I wont say its sabotage, just poor technical ability.
The problem with CAPTCHAs is that bots are now better than most humans at solving them, so they keep getting more and more difficult. The wiggly-text style was okay until they started putting in extraneous lines that look almost like letters. Do I count that skinny line as an I and that little bubble as an O?
Then they began using the images divided by a grid. "Click on all cars in this picture" seems simple enough, but do you include the frame that has the tiny bit of car roof at the bottom or one pixel of front bumper? I have tried them both ways, and every time I have to go through at least six images before I hit one that works. At random, they will slip in an image so dark and fuzzy that you can't tell what's in it. I have totally given up on using any form of Google account, purely because I can no longer solve their CAPTCHAs.
I want a USB hardware key that I can plug into whatever I'm using at the time, or something like having my iPhone act as my identification when it's on the same network as the device I'm using.
It's been 2 days, we're still getting CAPTCHAs.
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.