>You don't have permission to access "http://www.nasdaq.com/articles/an-interns-guide-to-trading-2..." on this server.
>Reference #18.e0745968.1625685764.2ef97a3a
Why do sites do this? Yes, I'm using Tor Browser to protect my privacy and stop big companies from tracking me. But I can just plug the URL into an archive service and read it from there.
you’re simply not their target audience. everything else is fantasy.
Any major player with an actual security dept is going to have evaluated just blocking Tor - or they are wildly irresponsible. It's a relative low effort way to get a win on security with minimal harm to customers and particularly paying customers.
Their sec ops team will be subscribed to things like DHS CISA alerts.
Alert (AA20-183A) Defending Against Malicious Cyber Activity Originating from Tor
They will evaluate the least effort approach and potentially follow it.
Then they have to make that decision about every site. And re-evaluate that decision every so often.
Every time a security practitioner has to make a new decision, that opens up the possibility of making a mistake. Therefore, it is good practice to limit the number of decisions that you have to make.
That's why the standard policy for firewalls is default deny, and you have to make an affirmative decision to let packets in.
That's why we make cost-benefit decisions about blocking policy.
Does it cost NASDAQ to block Tor exit nodes from reading their blog? Not materially. Anyone that desperate to read that material anonymously can ask the Internet Archive for it, or get some other proxy to pull it for them. None of their actual or potential clientele will feel the need to use Tor.
Does it benefit NASDAQ to have a general policy of blocking Tor exit nodes? Yes, it definitely does. If you want to probe a site's security, Tor and rented botnets are the sources of choice.
I don't know whether NASDAQs security people are competent or not in general, but in this specific example, they made a good choice.
Uh... that's worse than a security fetish.
Insurance companies are putting incredible pressure for business to lock down their IT HARDER not less hard.
Seriously, look for tor to get blocked lots more places.
"security fetishists" are going to be making good money for a while yet.
We're rolling out tor blocking our sites where we didn't used to need that. I think more automated options as well will come (think cloudflare) which will help folks with this as well and maybe jam tor users into perhaps recaptcha loops or similar? Not sure what right solution is to filter out the tor users - hard block or try and detect and recaptcha etc.
Imagine a bogus post ending up on their blog that crap cryptocoins have been approved by regulators for direct trading / custody and some random ETF has gotten approval for a direct coin ETF offering etc.
The cost/benefit of dealing with tor on your network for a place like Nasdaq is not even close - NO BENEFIT to allowing it. Literally no one they care about (ie, folks paying them big bucks) will complain if it is blocked. So it's blocked. Simple.