Hacker News Reader

Comment by nonrandomstring | Hacker News Reader

> My only issue is that is seems to have become increasingly difficult to access many websites through their servers.

Welcome to the world of Tor users. People who value online dignity need to work together against privacy hostile web technologies. My present bugbear is Cloudflare, who seem to do a lot to disrupt privacy respecting technologies. Ultimately though, the power lies with web service designers. One can no longer pretend "I didn't know" when turning over delivery to some cheap (free) but shady CDN who then blocks millions of legitimate users because they don't want to be tracked and spied on.

View on HN

Yea problem from an admin perspective is that all malicious traffic attempts to use privacy respecting technology. It’s more guilt by association than anything else for the legitimate users.

One of the weird realities is that in order to combat fraud you need to be able to identify the source, which is a hard reality as a privacy advocate.

HN tends to be pretty micropayment / cryptobro averse (for good reason, mostly) but I think this is a problem that crypto could legitimately solve - Tie an anonymous 'identity' to a well-seasoned (unmoved for >x time, where x = days for some things or maybe years for some things) wallet with some reasonable amount of funding in it ($100 or something) and you become 'Guy who owns that hundred bucks'. Moving the hundred bucks unseasons it. The provider only respects your claim to be an individual if you can prove you've got a pile of 100 seasoned bucks. If you do something I don't like, I can ban that pile from further interaction. Malicious users would immediately move the money around, but at least the malicious actors would need a lot of piles of money constantly moving around and 'seasoning' to create a bunch of fake individual identities, which gets prohibitively expensive at scale for all but nation-state type actors which you're not going to be able to defend against anyway.

Bam - I am anonymous, but have (mostly) proven I am a real person with (mostly) reasonably good intentions.

This is exactly how crypto solves the problem that another thread said Google was solving with your phone number. Phone numbers are expensive them say!

Its a put up or shutup kinda system. Fund your wallet with $100, hold it, and we will let you post that reaction to a news article after its been held continiusly for 30 days, and automatically delete is as soon as its unfunded.

I always thought the blacklistable credentials was a cool approach - we're you prove you control an ip but dont reveal it. https://www.cypherpunks.ca/~iang/pubs/blacronym-wpes.pdf

Your talking about earned capital as a forfeitable deposit. Sure that scheme has its place.

I joined HN for one or two reasons. To research a book. But also to promote my last book. Anyone can post here with a throwaway, yet I didn't want to be an interloping dick who felt entitled to hit and run posting links to my own vanities... so I decided; join, contribute, participate, earn. After a few months I don't feel bad about plying my own wares a little. Reputation (social capital) is natural and ancient and doesn't really need crypto.

Most of the Web isn't that though. As an information system, as Sir Tim first coined it, it's a publishing machine: You advertise a service, I send "requests", you send "responses", we part ways without complications. Quick anonymous sex on the beach. So-called Web2.0 f-cked that massively. Web2.0 wants to exchange phone numbers. And once the surveillance capitalist creeps latched on to stalking everyone around the neighbourhood... well here we are.

I think what some Web3.0 people think is that crypto can repair some kind of "middle ground", where Web2.0 type behaviours can take place but anonymously and under conditions controlled by "stakes". I think this won't work for psychological and game theoretical reasons we can't get into here. Instead I think we need to repair the Web1.0 layer at least, and since transport level security and anonymity have become necessary in a post-Snowden era, for me that means getting rid of the selective prejudice inflicted by systems like Cloudflare.

Where do you have the information from that "all malicious traffic attempts to use privacy respecting technology."? I just checked an access.log (from a searx instance) and an auth.log for malicious traffic and it doesn't look at all like that.

ssh bruteforce top 5 offenders:

147 (Tor: 0) TENCENT-NET-AP-CN

133 (Tor: 0) DIGITALOCEAN-ASN

31 (Tor: 0) CHINANET-BACKBONE

17 (Tor: 0) BAIDU

13 (Tor: 0) CHINANET-SH-AP

Overall there where 737 unique IPs from 241 ASNs and 1 was a Tor node.

access log top 5 offenders:

76 (Tor: 0) DIGITALOCEAN-ASN

58 (Tor: 0) CONTABO

54 (Tor: 0) AMAZON-AES

50 (Tor: 0) KAZTELECOM-AS

34 (Tor: 0) CORBINA-AS

Overall there where 1672 unique IPs from 618 ASNs and 4 where Tor nodes.

Not necessarily Tor, but a VPN could be coming from any of those sources.

I spent a recent chunk of my career combating fraud on a niche-eBay style site and the people trying to defraud other users, pay with stolen credit cards, login with phished credentials, etc were consistently trying to hide their origin.

Until we started using fingerprinting techniques to track them across multiple accounts and IPs, we had no way to spot this. It was a shock to me when I realized there were legitimate uses for fingerprinting technology because I'd always associated it with ad networks and trackers. They're fairly necessary for combating fraud though.

When we stopped letting any untrusted users run a credit card if their connection couldn't be trusted, our charge backs virtually stopped. That experience makes me completely understand sites scrutinizing anonymized traffic.

Most Tor exits block SSH and SMTP. Look elsewhere.

Not specifically picking on you (thanks for replying) but may I rephrase that a little and then ask something;

  "Sinners look just like saints, so it's necessary to punish all, to
  destroy the riches of the many in order that wicked few do not
  escape."

Is that a fair framing of the "ethics" of what you said? (I'm not attributing that as 'your' argument, I understand you're kinda just trying to 'explain' something as you see it).

Do you think this kind of thinking can continue to stand if technology is ever going to be fair and useful to everyone? Or do we just accept that technology always amplifies as least as many problems and injustices as it solves?

Short answer: I think companies will act to solve the problems they're experiencing.

I added some of my own experience here: https://news.ycombinator.com/item?id=31252676

If an army is attacking your border and somebody walks through them saying, "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire. Enter from the direction where the attacks aren't coming from and your odds will increase significantly.

Ultimately, companies will either adopt a very strict security policy on their own or they will respond to the problems that they are experiencing. If you are a US only company and you start getting malicious traffic from Romania, it's fairly common to just block all of Romania. When you're using tools like Maxmind for network identification, VPNs and Tor are just another traffic source that you can choose to block if it's causing you problems.

Thanks, good response.

What I'm getting is that you consider the "attack" an immediate mortal threat and the granularity of tools and techniques for discerning enemy/friendly identity and behaviour are lacking. The principle ethical stance is really self-preservation.

> "It's okay, I'm totally legitimate!" that person is probably still going down in the crossfire.

Nice analogy. I may have to steal that :)

Given that we can't rely on identity [1], can we improve analysis and response to behaviour?

[1] I see in an earlier response you talk a bit about fingerprinting, and of course anyone serious about privacy will modulate OS and browser FPs without malicious intent.

Again, also very situational.

For example, at the site where I worked we needed much stricter protection but we didn't want to bother the established users of the site...so we setup trust scores and implemented stricter controls on a sliding scale. The higher your trust score, the less strict we would be with our policies.

As a brand new user, your score was a flat 0. You could boost it by verifying a credit card, phone number and address (without using a VPN/Tor). Successful transactions rewarded your score. Transactions with established users are more valuable than transactions with other new users, etc.

All the security was virtually invisible to the established users and it worked like a charm.

Regarding the fingerprinting, at the time that we were doing this anti-fingerprinting technology barely existed. We had some other tricks in the bag too to fingerprint based on behavior. It was a lot of fun working on that stuff though. Very much a cat and mouse game.

No, because you're framing it like they're blocking or challenging every user that comes to their site. Instead, when 90% of your malicious traffic comes from VPNs/TOR, it makes way more sense to just block or challenge those specifically even if it causes an inconvenience on the ones who use those services in a non-malicious way.

> block or challenge

A reasonable challenge would probably be fine. But so many sites block, or sometimes use obnoxious unfair challenges.

Just to be clear I was asking that of the parent poster brightball.

I'm trying to map the technical explanations people give onto what may be going on for them at "ethical reasoning" level.

You're welcome to add your interpretation of course.

You probably guessed I'm looking to distinguish a Bentham from Mill sort of utilitarianism.

True, but as far as cloudflare goes - it doesn't explain why plain, probably cached, GET requests have to be behind a captcha. If that's really an issue, can't they save it for POST requests and other non-static endpoints.

>probably cached, GET requests

HTML isn't cached by default with cloudflare

The flip side to this is to have your site hammered by bots, scrapers and worms looking for exploits (look at your weblogs sometime and see how often Wordpress php pages are requested, lol). I don’t know what the middle ground is but in spirit I agree with you, especially in keeping the internet decentralized. In practice I’m not so sure.

When configured correctly you can use most of the cloudflares features such as WAF without blocking all tor/vpn users. Requires a little bit more than just flicking the „i’m under attack“ button though.

Reply on news.ycombinator.com