Hacker News Reader

Comment by ultramancool | Hacker News Reader

Hi,

I'm completely sympathetic to your problem - Tor is used by lots of spammers - totally understandable to try to prevent this spam from hitting your customers.

But most of the services I run can't really be affected by this sort of spam (no public comment systems for example). I use CloudFlare on a few of my domains, if I don't care about bot traffic and just want to turn this CAPTCHA system off entirely, is there a way with just a pro account to do so? I appreciate the anti-DDoS protection and certainly having it automatically kick these CAPTCHAs on with only extremely high volumes of traffic could be appropriate, but enforcing them is just too much.

I have security level set to minimum, but recently spun up a hidden service because users were still getting CAPTCHA'd over Tor.

View on HN

Yes, you can whitelist Tor. This is available at no cost for all customers regardless of plan level:

https://support.cloudflare.com/hc/en-us/articles/203306930-D...

Thanks. Can I whitelist the whole internet (by using /0 perhaps?) using this method? I've seen people complaining about this issue on VPNs and such too.

You can whitelist CIDR ranges of /16 and /24 currently. So yes, you can to some extent whitelist everyone.

If I can only to /16s at the largest, I would have to add on the order 65k ranges to accomplish it... not exactly desirable way to spend an afternoon. Even via API I don't think they'd be too happy with me.

I agree, this is not the most efficient way to whitelist everyone, but my point was to outline you can whitelist whoever you want. Hopefully support for wider ranges will be added.

Yes, just add 65536 exceptions!

No need to add 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, and a few others...

Yeah, I don't get why CloudFlare are so overaggressive with the captchas.

The vast majority of captcha'd pages by CloudFlare on Tor which makes secure web browsing so cumbersome are completely read-only, while some may have a comment system hosted by a third party like Disqus and Facebook (and are therefore protected already). Other sites should have the captchas on a different level than the front page, like the login forms and other pages where write/spam access is somehow enabled.

I can think of very few sites that are in need of a total ban on anonymous users/bots or that are write-access enabled by default without any login process.

"Read-only" pages are still fertile ground for layer 7 DDOS.

It wouldn't be hard to only display the captchas if sudden increased traffic from Tor exits indicated that a DDOS through Tor was in action.

Not only that but you could only display CAPTCHAs on the actual target of the DDoS.

The Tor egress bandwidth is sufficiently small and sparsely located that this wouldn't be an issue for a CDN.

It remains an issue for the origin server if the DDoS targets uncacheable content.

They also protect against ddos, sqli, overuse, bots etc. so comment spam is only one problem and get requests are not always safe.

You'd think they could be far more sophisticated about reputation though and adjust it in realtime so that ips are by default trusted and are marked down temporarily for bad behaviour.

The problem is that with Tor the IP isn't much use as an identifier to establish reputation. As CloudFlare say in their post, they do use reputation of the exit node IPs to some extent, but the trouble is that there's so much abuse from Tor, most exit nodes always have bad rep. The zero knowledge tokens t hat they talk about are a way of establishing reputation without losing anonymity.

What they do at present appears to be to assign long term reputation to tor nodes, but if instead they assigned reputation over a few minutes and reset it soon after, wouldn't that work better and avoid being overly broad? More load for them obviously but could possibly be done just for tor nodes.

The token scheme looks interesting though as long as it was truly anonymous and tokens were different on each request to avoid tracking.

https://github.com/gtank/captcha-draft/blob/master/captcha-p...

i wonder if they could do a plugin for the tor browser so that they don't have to wait for tor?

Other CDN/WAF providers are indeed doing that.

When are GET requests unsafe?

ddos or sqli, see the cf article

Reply on news.ycombinator.com