Hacker News Reader

Comment by ShakataGaNai | Hacker News Reader

I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate".

A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a blog entry? Don't need to test. Writing a comment? CAPTCHA them to the break of dawn.

View on HN

As a website operator too I don't see spammers, attackers and script kiddies from tor network with valid user agents (tor browser or mainstream up to date browsers). The worst I see in that traffic is very few people trying to post/upload something anonymously, but mostly it's just people trying to access a few pages anonymously. Bots and scrappers for some reason use fake user agents in tor network and just get 403s, but the amount of that is so tiny compared to the rest of the bots, that's it's not even worth mentioning. Tor network is sort of self-limiting in this regard, because it's too slow and too obvious for such use, it's only viable for casual browsing.

Cloudflare proved that it's both unwilling and unable to solve the problem.

If I _wanted_ to use a bot on your site, despite the captcha trying to prevent it... and you exempted tor users from the captcha... why _wouldn't_ I use tor to get around it?

I'm not sure when you last tried Tor, but it's not that slow these days. I first tried Tor several years ago, and it was so slow I couldn't understand how anyone could bear to use it - but I tried it again recently, and (to my surprise) for general browsing at least, it didn't seem to add any noticeable lag.

I wonder if Tor has finally reached critical mass and is ready for more widespread use?

The lag is quite noticeable for me - but it's quite similar to a bottom-5th-percentile internet connection. What was your uplink like when using Tor?

I'm on a 80/20 FTTC connection, if that's what you mean?

Not only do I use Tor a lot and find it mostly OK, but I use OrBot to encrypt traffic from other apps on my phone and most of the time I don't notice any overhead.

What I do is simply check if CF-IPCountry header == "T1" and block those from being able to register accounts. T1 is Tor.

Source and more info: https://support.cloudflare.com/hc/en-us/articles/200168236-W...

Do the same on the login page. You have to stop the bots from trying to brute force user accounts and passwords.

> You have to stop the bots from trying to brute force user accounts and passwords.

That shouldn't be an issue if the passwords have enough entropy.

>>> if the passwords have enough entropy.

Allow me to optimize your statement.

    >>> if False

What does it mean? Users always pick low-entropy passwords?

Almost always. It's gotten better with the rise of password managers that generate random passwords, but otherwise, passwords are usually shared across many websites and usually less than 16 characters.

Not "always". But you should not build your systems based on the assumption that passwords will be strong enough.

No amount of entropy mitigates a successful credential stuffing attack.

No amount of anything mitigates a successful attack; otherwise it wouldn't be successful.

It could be argued that once you use a password more than once its entropy decreases automatically.

Why not just captcha everyone?

Because it makes for a miserable user experience.

I always find a captcha on the second attempt and onwards a fine compromise

I run dedicated onion addresses for my sites and check the CF-IPCountry headers and just redirect Tor users to the Onion site.

That is indeed the most constructive approach. I mean, Facebook has an .onion site :)

How does that solve the spam/troll problem, though?

Definitely in line with your statement, I ran a forum for years. At one point I found an iptables script that blocked all known Tor endpoints. What happened was, trolls posting gore and porn to a child oriented forum (which had persisted for 2-3 years) immediately and totally stopped. People in these threads point out that "criminals can use a VPN", but in practice it never happened to us. I never once heard from anyone that a legitimate user was impacted.

It's not just Tor. This also affects VPN users. It has affected me. I wouldn't call my use of a VPN for privacy as "illegitimate."

It's not about whether your personal use of VPN is legitimate. It's a numbers game. For any successful site that deals in user generated content, moderation is hard and relentless work.

If they observe that a high fraction of visitors from AWS / VPN / Tor exit IPs are attackers, they will add countermeasures.

Then in deploying those countermeasures, they should know they're creating (sometimes significant) friction in the experience those legitimate users, who have legitimate reasons for using those tools, have of their site.

Well-intentioned or not, the UX sucks, and I generally bail and don't come back if I experience a second Captcha in a session. Find a better solution, or accept that you're driving away eyeballs/revenue.

As mentioned, this is a numbers game. Usually when this is deployed the cost of fighting the attackers exceeds any income the legitimate users via VPN or Tor respectively could provide.

They already know that and don't care.

> Find a better solution, or accept that you're driving away eyeballs/revenue.

Let's approach this from another angle for a moment - a hypothetical provider with no numbers/revenue; zero, zip.

Where should they start? Do they start by chasing every possible user out there and risk a wave of spam, etc? No, right now - the Cloudflare approach is looking rather attractive despite Cloudflare not needing to advertise these security features far and wide (unlike some VPN providers) because we're talking so much about it.

In the time that this debate will end, the buttons will be clicked, site(s) will be launched and working without problem for the majority of users it will be targeted at. For nearly everyone, this appears to be a much better solution than those that have plagued various online forums and services for years.

So who is going to find a "better" solution? Probably almost nobody. As the other commenter says, it's a numbers game. And that's just business.

And proxies, but not Cloudflare - I regularly have to complete captchas from Google when at work.

It would be cool if you could set a header to Cloudflare when a user is logged in, perhaps with that user's ID. That could then trigger significantly decreased security.

A kind of "if cookie exists in this format that indicates session then..." ?

That is interesting.

Their workers feature can do all kinds of things like this

Cloudflare already does that automatically.

The following are questions based on the fact that I am ignorant of Cloudflares services/capabilities:

Are you using Cloudflare purely as a CDN?

Can you choose to filter access to your content from geographic regions (i.e. block all IPs from [country])

What key services/offerings are you benefiting most from using Cloudflare?

1. You can use it purely as a CDN, turning security to "essentially off" and only having to deal with the website certificate being sni.cloudflaressl.com

2. Only on the enterprise plan. On Pro/Business you can only "challenge" (captcha) or JS/browser Challenge countries, not outright block them.

3. Even with all the other cool and useful features, DDOS mitigation is still one of the most valuable offerings possible.

You can do that with pagreules

meanwhile i2p users just fly under the radar

Actually probably not very much traffic is from tor. Tor bandwidth is notoriously bad.

are there any researched measurements to show exactly how much is available?

obviously it would vary greatly depending on where the connection is going... but wondering if there is some overarching idea of what it has..

https://metrics.torproject.org/bandwidth.html

Currently the network is processing ~125Gbit/s of traffic.

is there a way to see the average bandwidth a tor end user would get?

seems like a good amount?

I assume you mean exit traffic. Exit traffic is anything connecting to the open internet, whereas hidden services never leaves the Tor network.

For exit traffic I don't believe there is a metric for average user speed. But, I just ran a 3 speed tests using different circuits and was getting 500-800KB/s download speeds on average.

Try using it. Very slow. No matter where you are. I understand that some people have no choice other than to use it. so I stopped using it to leave whatever bandwidth there is in the exit nodes to them

I use it to control my 3d printers at our local hackerspace.

I have octoprint set up with a IP behind a NAT, and a hidden service. When I'm not at the 'space, I use Orbot on my android and OctoRemote.

I get reasonably good speeds and latency. I can also view my webcam on the printer. It's not 4HD by any means, but is definitely usable.

It wouldn't be surprising if hidden services had a lot better performance. Running a guard node is a lot less risky than an exit, so there's probably a lot more capacity available for traffic staying inside the network.

That makes a lot more sense, regarding in-Tor bandwidth.

I've also had quite a few projects in which I'm trying to normalize Tor usage. My biggest one thus to date is a Tor-ified IoT network that uses your own resources instead of nebulous "cloud" providers.

https://hackaday.io/project/12985-multisite-homeofficehacker...

Long story short, there's a lot of promise to a .onion address, given it acts like a telephone number. Change IPs? Who cares. You retain your "number" no matter where you move :) It's also a lot less scary when talking to people about this, and how Tor is awesome in many areas.

Yes, Tor hidden services are neat technology, using them for IoT is a clever idea. Authenticated, not really scannable and you avoid the typical issue of going out to someone pre-determined to get connectivity from the outside.

This only works for HSv3 though. HSv2 addresses are enumerable without too too much work.

They perform quite worse:

https://metrics.torproject.org/torperf.html?start=2018-05-15... https://metrics.torproject.org/torperf.html?start=2018-05-15...

You can see that for a 5MiB file, hidden services perform 2-3 times slower, I would put most of the blame on data having to travel through more hops when using hidden services.

Interesting, thanks for the correction and links.

You can see that for a 5MiB file average download time is around 12 seconds [0], which is around 425KiB/s, the main problem with Tor is latency, downloading a 50KiB file takes around 1 to 2 seconds.

[0] https://metrics.torproject.org/torperf.html?start=2018-05-15...

Tor bandwidth and TTFB used to be universally very bad for me, no matter what I was doing.

Some time around ~2 years ago, though, the particular use-case of using Tor to (anonymously) access public-Internet websites got a lot better—both in bandwidth and TTFB.

Access to Tor hidden services is still slow, though.

Which makes me wonder: is the Tor network itself unilaterally faster now, and it's actually just the particular Tor hidden services which are all coincidentally bandwidth-starved?

Comparing apples to apples, DuckDuckGo's hidden-service gateway (https://3g2upl4pq6kufc4m.onion/) still seems a lot worse-off than their clear-net website (https://duckduckgo.com/). And I would bet that they would scale their Tor gateway if they could. So maybe this is a limitation in how Tor handles routing to hidden services? Does a .onion have to route to one physical Tor node, rather than being capable of load-balancing among many?

The answer to your first question according to Cloudflare is 94% of Tor traffic is malicious, circa 2016: https://blog.cloudflare.com/the-trouble-with-tor/

94% of all traffic on the internet is malicious. It all depends on your definitions. A legitimate, human, user makes a handful of connections per minute. Someone running a scanner attempts thousands per second. So if we measure attempted connections then Tor and everything is horrible. But that true for actual bandwidth.

The old question: is a simple ping considered an attack? I still here people talking of how their websites are attacked thousands of times every day. Pings and other simple scans are not what I would call actual attacks.

Hmmm, this sounds really interesting!

Do we have any sources regarding how that 94% number was calculated or are you guessing?

Run a firewall on a server. Count every ping/scan as an attempted hack. Say you have 1000 legitimate users in a give day. You will probably see 1000 pings, scans, and other general junk per hour. (This is hard to do in places like cloudflare that filter much of this junk traffic before it hits their customers.)

So far I'm with you and I think I might agree with your conclusion.

What I wanted to know was some background on the 94% figure, do we now this is how they arrived at that number?

Reply on news.ycombinator.com