Tor has acknowledged their "botnet problem" since at least 2013:<p><a href="https://research.torproject.org/techreports/botnet-tr-2013-11-20.pdf" rel="nofollow">https://research.torproject.org/techreports/botnet-tr-2013-1...</a><p>That same paper walks through the challenges of dealing with it and doesn't find any satisfactory solutions.<p>As I wrote in our post on the topic, there's a trade off between security, anonymity, and convenience. CloudFlare provides security to our customers. We believe in the importance of anonymously accessing the Internet. Unfortunately, that means we have to sacrifice some convenience. If you haven't read it, I encourage you to see the post I wrote on the topic:<p><a href="https://blog.cloudflare.com/the-trouble-with-tor/" rel="nofollow">https://blog.cloudflare.com/the-trouble-with-tor/</a><p>The two long-term solutions we proposed — blinded tokens or CloudFlare supporting .onion addresses — we believe could reduce the inconvenience, but they'll require help from the Tor developers. While public posts like this are discouraging in terms of coming up with a better solution, I'm encouraged by private conversations we've had with Tor developers who acknowledge this is a hard problem and want to find solutions.
Maybe I'm a cranky, old-school network operator, but this is a very cut and dry problem. Tor runs a network that is rife with abuse and fraud. Tor needs to clean up and police its network. If it doesn't, it will be put on blacklists and customers will take active measures to block traffic from it.<p>This is no different than a network or AS that is spammer friendly, botnet friendly, carder friendly, etc. All of those networks eventually end up on blacklists or Spamhaus lists and their efficacy goes down. Eventually, the network dies out and the criminals move somewhere else. Yes, it's a game of whack-a-mole, but it's proven to work well.<p>I know Tor doesn't want to be in the network regulation business, but they need to be if they want their product to thrive. Otherwise, good bye Tor.
I think Cloudflare's blog post was incredibly nuanced, well thoughtout and (dare I say) pro-Tor. They implemented a way for their users to whitelist Tor traffic (bypassing all Captcha's), without allowing their users to blacklist Tor traffic.<p>This response seems a bit of a childish knee-jerk reaction from the Tor project, which could've been worded more maturely.
I [I'm CloudFlare's CTO] have been engaging with the Tor folks through their Trac interface here for about 6 weeks: <a href="https://trac.torproject.org/projects/tor/ticket/18361" rel="nofollow">https://trac.torproject.org/projects/tor/ticket/18361</a> and been very open about CloudFlare is addressing this.<p>My plan is to continue to do so through that ticket as I've made various commitments there (some of which, like whitelisting, we've already rolled out). It's worth reading the entire ticket to get a sense of the conversation. We are in no way finished improving the situation.
That's just flawed reasoning all around. I can't even find any e-commerce-specific data in their sources.<p>> A report by CloudFlare competitor Akamai found that the percentage of legitimate e-commerce traffic originating from Tor IP addresses is nearly identical to that originating from the Internet at large. (Specifically, Akamai found that the "conversion rate" of Tor IP addresses clicking on ads and performing commercial activity was "virtually equal" to that of non-Tor IP addresses).<p>Actual data from the report:<p><pre><code> • Comparison of Tor and non-Tor Traffic:
Of legitimate requests, non-Tor IPs accounted for 99.96 percent of requests, while Tor exit nodes accounted for 0.04 percent
Of malicious requests, non-Tor IPs accounted for 98.74 percent of requests, while Tor exit nodes accounted for 1.26 percent
• Tor exit nodes were far more likely to contain malicious requests:
1:11,500 non-Tor IPs contained malicious requests
1:380 Tor exit nodes contained malicious requests
• However, traffic from Tor exit nodes yielded a conversion rate virtually equal to non-Tor IPs:
Conversion rate for non-Tor IPs was 1:834
Conversion rate for Tor exit nodes was 1:895
</code></pre>
Source: slide 7 of the report they link in the article – <a href="https://i.imgur.com/TcstnWD.jpg" rel="nofollow">https://i.imgur.com/TcstnWD.jpg</a>
I don't know what the solution is here.<p>One of my sites enjoys a ridiculous number of fraudsters trying to make purchases, many - but very much not all - from the tor network.<p>The easy solution is to punish everyone and ban tor exit nodes from access, and woo, a significant reduction in my fraud rate.<p>The way I justify this to myself is that the site only accepts payment via PayPal and/or credit cards, and paying with those in itself gives up a good amount of privacy.<p>For sites that don't make a profit and have to use unpaid time to clean up the mess from some tor nodes, I really don't know what the solution is.<p>It definitely sucks for legitimate users.<p>Edit: one more difficulty is that I don't know if I was targeted by one or two lazy-yet-determined fraudsters who only use tor, and so make tor look worse than it is with their repeated attempts. No idea even where to begin with that one.
I feel like Tor is burying their head in the sand here.<p>I think Tor is great, but I don't find it at all surprising or unlikely that 94% of <i>traffic</i> (not users) is malicious (spam, vulnerability scanning, scraping, etc) because it's likely that malicious traffic is automated while legitimate traffic is not.<p>That said, I'd also like to hear more about CloudFlare's methodology.
Exchanged comments with Cloudflare's CEO on the topic and in my opinion it appears that they simply don't understand that their view of the situation is skewed.<p>Here's hoping that given they truly do appear to care about TOR users that they'll revisit the situation and find a better solution.<p>Here's a link to Cloudflare's blog post an the related comments on HN:<p><a href="https://news.ycombinator.com/item?id=11388560" rel="nofollow">https://news.ycombinator.com/item?id=11388560</a>
> 5) A report by CloudFlare competitor Akamai found that the percentage of legitimate e-commerce traffic originating from Tor IP addresses is nearly identical to that originating from the Internet at large. (Specifically, Akamai found that the "conversion rate" of Tor IP addresses clicking on ads and performing commercial activity was "virtually equal" to that of non-Tor IP addresses).<p>This point seems rather odd. I'm not following the connection between a large percentage of Tor requests being malicious and the fact that Tor users have almost the same conversion rate. Malicious requests are coming from botnets and/or fraudsters. They're, for the most part, not in the subset of Tor users which click ads or do anything else that would be tracked as part of a site's conversion rate. What's funny about this is that the linked report even confirms that requests from exit nodes are far more likely to be malicious:<p><pre><code> Tor exit nodes were far more likely to contain malicious requests:
• 1:11,500 non-Tor IPs contained malicious requests
• 1:380 Tor exit nodes contained malicious requests
</code></pre>
I'm a huge supporter of Tor and have been running a relay node for years, but it seems their stance on this topic is quite fundamentalist and they chose to ignore any arguments or facts that they don't like while basically grasping at straws in their counterarguments.<p>It's okay to be concerned about CloudFlare having such a huge market share. They're a <i>huge</i> target for nation states and others alike. Global passive¹ adversaries are a problem for things like Tor, and they might very well be forced to become one at some point. It's essential to have more competition in this area, and that's a fair argument to make. However, with regards to how they're handling Tor, I don't think there's anything wrong with what they're doing, and the explanations presented in their blog post seemed sound to me.<p>¹ Or, rather, possibly an active adversary too?
Original Cloudflare blog post that this is a response to: <a href="https://blog.cloudflare.com/the-trouble-with-tor/" rel="nofollow">https://blog.cloudflare.com/the-trouble-with-tor/</a>
This is a tough situation. I don't know about 94% of TOR traffic being fraudulent but I'm sure it's high. But I'm one of the legit users that gets taken out by blacklisting. I use a VPN service pretty regularly and it makes accessing my Cloudflare account and sites using it incredibly annoying.
The really questionable thing CloudFlare seems to be doing is that they captcha traffic depending on the overall reputation of only the source IP rather than whether the source IP is attacking that specific site or even whether the site is under attack.<p>What they should do instead is this:<p>1. If the server is not overloaded, do not captcha any traffic at all<p>2. If the server starts being overloaded, only captcha traffic from IPs that have been detected as attacking THAT specific site<p>3. If the server is still overwhelmed, only then switch to captchaing all IPs with "bad reputation"<p>Most websites are probably almost never under attack, so this would make encountering CloudFlare captcha extremely rare in the wild while still providing DDOS protection.<p>They could even only do this for Tor exit nodes and other IPs that are known to be used by lots of people.<p>If a site is being DDOSsed a lot and the slower start up of this technique is a problem, then they can revert for those sites to the current behavior of using reputation.
I find Cloudflare's argument analogous to that of cash - i'm sure some huge percentage of all illegal transactions are with cash, but that does not mean the solution is to ban cash...though some would probably disagree
I find the 94% figure believable (for requests, not source IP addresses), Tor is after all the obvious choice for low bandwidth DoS attacks and unwanted scraping (i.e. a few individuals will generate a large percentage of Tor-routed requests at any time).<p>The real issue with CF for me isn't the hassle with captchas, but the fact that CloudFlare can track users across all its sites, generate profiles and even read unencrypted traffic. It's a privacy hazard by design that makes Tor particularly attractive. But as long as Tor is used only by a small minority, it will be treated this way.
I would expect most of the malicious traffic coming out of Tor isn't using Tor browser. I wonder what the attack numbers look like for Tor browser vs not Tor browser. Cloudflare has client side checks already, which could be extended to check whether the browser is Tor browser, and if so, don't block it.
I understand what CloudFlare is saying but I still think that the benefits of allowing legitimate TOR users access websites freely (without cumbersome captchas) outweighs the troubles malicious users might cause. Public computers such as in Libraries are also often used to do reprehensible things, but still, we understand the benefits of having them.<p>It is also worrying that CloudFlare has this much power. One of the greatest things about the internet is the openness of the platform and the non existence of gate keepers.<p>Also, here is an annotated version of the TOR paper for those who want to read more about it <a href="http://fermatslibrary.com/s/tor-the-second-generation-onion-router" rel="nofollow">http://fermatslibrary.com/s/tor-the-second-generation-onion-...</a>
> Users are either blocked outright with CAPTCHA server failure messages, or prevented from reaching websites with a long (and sometimes endless) loop of CAPTCHAs<p>Is it really a loop or are users just failing to solve the CAPTCHAs? A loop would be obnoxious: Just tell the user they are blocked; giving them more than 2 or infinite CAPTCHAs is a passive aggressive way to communicate.
This is a terrible reply, it's basically say's "It's all your fault, we're all good over here."<p>They then either because they legitimately can't understand the problem, which would be scary, or because they're being stubborn fail to address the suggestions by cloudflare to address the issues.
The trouble with Clouflare is that they receive disproportionate amount of attention on Hackernews. Sometimes HN feels like an extension of their marketing machine. I'm not so sure they every single blog post of their needs to be an item on HN. Anyway that's my .02 cents.
I have a question that I'm hoping will spur some discussion and maybe I can learn some stuff.<p>"Is anonymity in Tor incompatible with low-latency?"<p>I ask this having read this:
<a href="http://freehaven.net/anonbib/cache/pets13-flow-fingerprints.pdf" rel="nofollow">http://freehaven.net/anonbib/cache/pets13-flow-fingerprints....</a><p>I suspect that countermeasures to defeat deanonimization all have a negative impact on latency(e.g. inserting extra packets, pausing between sends).<p>If the answer to my question is yes, then maybe the best thing the Tor project can do is abandon its push for low latency, and instead focus on anonymity. If Tor we're a much higher latency network attackers would probably find it less interesting.
To me personally all of this just seems like fluff. I can't be the only one that feels this way.<p>I don't want to 'prove I'm a human' to view your crappy site. I'll go and look at the other bits of the Internet instead.<p>As an individual browsing, the only contact I have with CloudFlare is a bouncer telling me 'no shoes no entry'.<p>Your entire company to me feels like a pointless gatekeeper because of these shenanigans (on and off of Tor).<p>To be perfectly clear - CloudFlare, as a brand, is tainted to me, and I expect to many others.<p>Fundamentally I don't think CloudFlare cares because their customers are not the viewers of websites - and if the viewers of websites come to think of CloudFlare as toxic - it still doesn't matter to them directly.
That post doesn't really offer any solutions.<p>It would be interesting to find out how CF came to the 94% figure but a lot of the other claims made are not countered and presumably valid.<p>I doubt CF's (paying) customers are particularly saddened by Tor users being inconvenienced.
CloudFlare looks for ways to justify doing less. First ANY queries, then "free" HTTPS stopping at the first CloudFlare hop, and now the stuff with Tor. I don't trust CloudFlare <i>at all</i>, because they say they're holding a torch for the good of humanity, when actually, they're just making "cut costs" business decisions. If you want to do something becuase it costs less, I understand, then do that. But don't sit there and try to tell me that you're somehow doing it to make the world a better place. That, to me, is super scummy.
The main problem with CloudFlare is how dumb their "protection" is.<p>It doesn't make sense at all to block Tor users from just accessing read-only content, like CloudFlare does today. Forms/login pages/comment boxes etc should be protected of course, and most people wouldn't have anything against solving a captcha for logging in, but preventing people from just reading stuff anonymously/securely is borderline evil from a user experience point of view.<p>However it's obviously much easier from an engineering standpoint though to just block people outright.
I think CloudFlare's security measures are insane. I use a VPN and I can tell which sites use CloudFlare because I consistently get a Error 520, where it claims the browser and CloudFlare are working, but the website is not responding. Yet I turn of the VPN and magically it works fine. That's dishonest. At least own that you are the one blocking my visit.<p>I'm also developing with Dwolla's API, and CloudFlare blocks all HTTP requests from my local IP, so I can't develop locally. Thanks CloudFlare.
Someone with more knowledge of these thing, let me know:<p>Why does Tor not "charge" per request? i.e. Using some decentralized currency, to pay for requests.<p>1. Make it cheep enough such that users don't care, however, financially disincentives spammers/malicious users.<p>2. It would continue to be anonymous. - cycle through wallets - all transactions would also be proxied.<p>3. It would incentivize proxying and exit nodes (exit nodes would effectively collect a bunch of virtual money to be resold to clients for USD).
Services like CloudFlare are responsible for more and more of the DNS. When they are poor net citizens, they are poor net citizens at a massive scale. Heuristics that end up being equivalent to "Tor users are guilty until proven innocent" can't become the default mode of the Internet. As customers, Tor users, and just people who have a stake in the Internet as a shared resource, we need to demand that they try harder than that.
Anonymity ("privacy") and security are conflicting requirements. Tor users take a legit stance, and would be served an equally legit CAPTCHA (if lucky).
How about this solution: (yes, it's only 5% serious)<p>From every publically available internet do something that appears malicious until cloudflare's servers annoy everyone. At that point they'll be forced to find a new solution.<p>This only occurred to be because I get their captchas on public wifi in Starbucks and other public wifi in Japan
I'm getting<p>"Attackers might be trying to steal your information from blog.torproject.org (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID"<p>When trying to visit this blog post.
CloudFlare uses a flawed algorithm that penalizes developing countries and anyone who uses 1 IP address for many users. And that means that it censors Tor users and impedes human rights.
I dislike CloudFare adoption.
More and more I come to sites and need to wait 5 seconds, caused by their DDoS protection. Such things make the less more and more aweful.
>the site only accepts payment via PayPal >and/or credit cards, and paying with those in >itself gives up a good amount of privacy.<p>I think both methods areactually not private and have proven not te be private at all
>the site only accepts payment via PayPal >and/or credit cards, and paying with those in >itself gives up a good amount of privacy.<p>i think both methods have proven not to be private at all.