Comment by Artemis2 | Hacker News Reader

Comment by Artemis2 | Hacker News Reader

That's just flawed reasoning all around. I can't even find any e-commerce-specific data in their sources.

> A report by CloudFlare competitor Akamai found that the percentage of legitimate e-commerce traffic originating from Tor IP addresses is nearly identical to that originating from the Internet at large. (Specifically, Akamai found that the "conversion rate" of Tor IP addresses clicking on ads and performing commercial activity was "virtually equal" to that of non-Tor IP addresses).

Actual data from the report:

  • Comparison of Tor and non-Tor Traffic:

  	Of legitimate requests, non-Tor IPs accounted for 99.96 percent of requests, while Tor exit nodes accounted for 0.04 percent

  	Of malicious requests, non-Tor IPs accounted for 98.74 percent of requests, while Tor exit nodes accounted for 1.26 percent

  • Tor exit nodes were far more likely to contain malicious requests:

  	1:11,500 non-Tor IPs contained malicious requests

  	1:380 Tor exit nodes contained malicious requests

  • However, traffic from Tor exit nodes yielded a conversion rate virtually equal to non-Tor IPs:

  	Conversion rate for non-Tor IPs was 1:834

  	Conversion rate for Tor exit nodes was 1:895

Source: slide 7 of the report they link in the article – https://i.imgur.com/TcstnWD.jpg

[IP addresses of] Tor exit nodes were far more likely to contain malicious requests

However, traffic from Tor exit nodes yielded a conversion rate virtually equal to non-Tor IPs

You just described every busy IP address: if you handle more requests, you are more likely to handle a malicious one. This is the problem with IP based reputation.

Yes, I think that the more revealing ratio would have been total malicious requests to all requests for each class of IP. If each Tor exit node is sending out 30x as much traffic, with an average of 30 unique users per IP, then the cited ratios are meaningless.

The only thing that can be drawn from that data is that Tor makes IP-based reputation tools ineffective. The thing is, for many people that may be enough to justify what Cloudflare is doing.

That's what CloudFlare did in their blog post:

> Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious.

That number does not fit with the 1:380 ratio of Tor IPs that emitted malicious requests, though. That is, unless the vast majority of all Tor traffic is routed out of only a couple of exit nodes, which does not seem consistent with the way that Tor works.

How can Cloudflare assert that 94% of all requests over Tor are malicious, when Akamai seems to be saying that less than 1% of Tor IPs contain malicious requests?

> That's just flawed reasoning all around.

Starting with a blanket blaming statement isn't that great either. Conversion rates and e-commerce sorta go together, so I would say it's fine to entangle them logically. Tor exit nodes entangle users with each other through an IP. If someone's lens is limited, they'll run the risk of blanket blaming the legitimate traffic as well.

> Tor exit nodes were far more likely to contain malicious requests

That's comparing apples to oranges though. A lot of different people send requests from tor exit nodes. That might be comparable to some corporate networks, but many IP addresses are used by only one person (or a family).

Intuition would suggest that tor traffic is more likely to be malicious than average traffic, but suppose there are 500 tor exit nodes in the world, and 1 malicious tor user: then 1 in 500 tor-exit node IPs would have sent a malicious request!

Reply on news.ycombinator.com