I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate".
A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a blog entry? Don't need to test. Writing a comment? CAPTCHA them to the break of dawn.
As a website operator too I don't see spammers, attackers and script kiddies from tor network with valid user agents (tor browser or mainstream up to date browsers). The worst I see in that traffic is very few people trying to post/upload something anonymously, but mostly it's just people trying to access a few pages anonymously. Bots and scrappers for some reason use fake user agents in tor network and just get 403s, but the amount of that is so tiny compared to the rest of the bots, that's it's not even worth mentioning. Tor network is sort of self-limiting in this regard, because it's too slow and too obvious for such use, it's only viable for casual browsing.
Cloudflare proved that it's both unwilling and unable to solve the problem.
If I _wanted_ to use a bot on your site, despite the captcha trying to prevent it... and you exempted tor users from the captcha... why _wouldn't_ I use tor to get around it?
I'm not sure when you last tried Tor, but it's not that slow these days. I first tried Tor several years ago, and it was so slow I couldn't understand how anyone could bear to use it - but I tried it again recently, and (to my surprise) for general browsing at least, it didn't seem to add any noticeable lag.
I wonder if Tor has finally reached critical mass and is ready for more widespread use?
Not only do I use Tor a lot and find it mostly OK, but I use OrBot to encrypt traffic from other apps on my phone and most of the time I don't notice any overhead.
Almost always. It's gotten better with the rise of password managers that generate random passwords, but otherwise, passwords are usually shared across many websites and usually less than 16 characters.
> I just can't imagine any legitimate Tor user checking that checkbox
Legitimate Tor users will click it for the same reason a large fraction of users in general will click it--it's stopping them from getting where they want to be, and they believe clicking it enable them to move on, and they believe that reading it won't speed up that process.
It's just to them more "stupid stuff the site wants me to agree to that I don't need to bother with because (1) if it is asking me to agree to some rules I don't care because I'm really nice and would never do anything they could object to anyway, and (2) if it is making me give permission to use my data or track me it doesn't matter because (I'm already tracked everywhere else | I've got ad blocking and privacy add-ons installed)".
Good point! Since my suggestion actually would not stop trolls (abusive users) anyway (they would just click it so they could then abuse the site), how about blocking all Tor traffic with this message:
"
Why we are blocking Tor users
You appear not to support dictatorship and or want to live under a dictatorship. As the operator of this site, I don't believe in freedom of speech or expression on any subject, even banal everyday subjects. For all subjects, I oppose freedom of the press, freedom of speech, and the right to read anonymously or express anonymous opinions, regardless of content. If I could, I would repeal the fourth amendment ('[t]he right of the people to be secure in their persons, houses, papers, and effects'). Come back when you are ready to be tracked by your government."
Fair compromise? It sends the message across while blocking all Tor users.
Yes, the other poster has pointed out that some legitimate Tor users might click "agree" just to be able to use the page, without really agreeing with it.
so in my sibling comment I suggested that all Tor users could be blocked, while making it clear that the operator does not support their rights.
Definitely in line with your statement, I ran a forum for years. At one point I found an iptables script that blocked all known Tor endpoints. What happened was, trolls posting gore and porn to a child oriented forum (which had persisted for 2-3 years) immediately and totally stopped. People in these threads point out that "criminals can use a VPN", but in practice it never happened to us. I never once heard from anyone that a legitimate user was impacted.
It's not about whether your personal use of VPN is legitimate. It's a numbers game. For any successful site that deals in user generated content, moderation is hard and relentless work.
If they observe that a high fraction of visitors from AWS / VPN / Tor exit IPs are attackers, they will add countermeasures.
Then in deploying those countermeasures, they should know they're creating (sometimes significant) friction in the experience those legitimate users, who have legitimate reasons for using those tools, have of their site.
Well-intentioned or not, the UX sucks, and I generally bail and don't come back if I experience a second Captcha in a session. Find a better solution, or accept that you're driving away eyeballs/revenue.
As mentioned, this is a numbers game. Usually when this is deployed the cost of fighting the attackers exceeds any income the legitimate users via VPN or Tor respectively could provide.
> Find a better solution, or accept that you're driving away eyeballs/revenue.
Let's approach this from another angle for a moment - a hypothetical provider with no numbers/revenue; zero, zip.
Where should they start? Do they start by chasing every possible user out there and risk a wave of spam, etc? No, right now - the Cloudflare approach is looking rather attractive despite Cloudflare not needing to advertise these security features far and wide (unlike some VPN providers) because we're talking so much about it.
In the time that this debate will end, the buttons will be clicked, site(s) will be launched and working without problem for the majority of users it will be targeted at. For nearly everyone, this appears to be a much better solution than those that have plagued various online forums and services for years.
So who is going to find a "better" solution? Probably almost nobody. As the other commenter says, it's a numbers game. And that's just business.
It would be cool if you could set a header to Cloudflare when a user is logged in, perhaps with that user's ID. That could then trigger significantly decreased security.
1. You can use it purely as a CDN, turning security to "essentially off" and only having to deal with the website certificate being sni.cloudflaressl.com
2. Only on the enterprise plan. On Pro/Business you can only "challenge" (captcha) or JS/browser Challenge countries, not outright block them.
3. Even with all the other cool and useful features, DDOS mitigation is still one of the most valuable offerings possible.
Tor bandwidth and TTFB used to be universally very bad for me, no matter what I was doing.
Some time around ~2 years ago, though, the particular use-case of using Tor to (anonymously) access public-Internet websites got a lot better—both in bandwidth and TTFB.
Access to Tor hidden services is still slow, though.
Which makes me wonder: is the Tor network itself unilaterally faster now, and it's actually just the particular Tor hidden services which are all coincidentally bandwidth-starved?
Comparing apples to apples, DuckDuckGo's hidden-service gateway (https://3g2upl4pq6kufc4m.onion/) still seems a lot worse-off than their clear-net website (https://duckduckgo.com/). And I would bet that they would scale their Tor gateway if they could. So maybe this is a limitation in how Tor handles routing to hidden services? Does a .onion have to route to one physical Tor node, rather than being capable of load-balancing among many?
I assume you mean exit traffic. Exit traffic is anything connecting to the open internet, whereas hidden services never leaves the Tor network.
For exit traffic I don't believe there is a metric for average user speed. But, I just ran a 3 speed tests using different circuits and was getting 500-800KB/s download speeds on average.
You can see that for a 5MiB file average download time is around 12 seconds [0], which is around 425KiB/s, the main problem with Tor is latency, downloading a 50KiB file takes around 1 to 2 seconds.
Try using it. Very slow. No matter where you are. I understand that some people have no choice other than to use it. so I stopped using it to leave whatever bandwidth there is in the exit nodes to them
It wouldn't be surprising if hidden services had a lot better performance. Running a guard node is a lot less risky than an exit, so there's probably a lot more capacity available for traffic staying inside the network.
That makes a lot more sense, regarding in-Tor bandwidth.
I've also had quite a few projects in which I'm trying to normalize Tor usage. My biggest one thus to date is a Tor-ified IoT network that uses your own resources instead of nebulous "cloud" providers.
Long story short, there's a lot of promise to a .onion address, given it acts like a telephone number. Change IPs? Who cares. You retain your "number" no matter where you move :) It's also a lot less scary when talking to people about this, and how Tor is awesome in many areas.
Yes, Tor hidden services are neat technology, using them for IoT is a clever idea. Authenticated, not really scannable and you avoid the typical issue of going out to someone pre-determined to get connectivity from the outside.
You can see that for a 5MiB file, hidden services perform 2-3 times slower, I would put most of the blame on data having to travel through more hops when using hidden services.
94% of all traffic on the internet is malicious. It all depends on your definitions. A legitimate, human, user makes a handful of connections per minute. Someone running a scanner attempts thousands per second. So if we measure attempted connections then Tor and everything is horrible. But that true for actual bandwidth.
The old question: is a simple ping considered an attack? I still here people talking of how their websites are attacked thousands of times every day. Pings and other simple scans are not what I would call actual attacks.
Run a firewall on a server. Count every ping/scan as an attempted hack. Say you have 1000 legitimate users in a give day. You will probably see 1000 pings, scans, and other general junk per hour. (This is hard to do in places like cloudflare that filter much of this junk traffic before it hits their customers.)
A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a blog entry? Don't need to test. Writing a comment? CAPTCHA them to the break of dawn.