CloudFlare Working On New System That Removes CAPTCHAs For Tor Users (softpedia.com) 54
Tor users have long criticized CloudFlare for annoying CAPTCHAs, but it appears the CDN provider is finally working on a fix. An anonymous reader writes: CloudFlare is working on a new system called "Challenge Bypass Specification," which it wants to deploy as a Tor Browser extension and replace the CAPTCHAs Tor users see when trying to access a website protected by CloudFlare. This new system will have users solve one CAPTCHA at the beginning and after that, the browser extension will use nonces (one-time authentication tokens) to prove the user's real identity before accessing a CloudFlare-protected site.
Identifying the user?? (Score:1)
One time token per Tor user.... doesn't that mean it identifies the user??? Sounds anti-Tor.
Re: (Score:2)
This is nothing that can't be done with any old cookie. In fact, it probably uses them. If anything, this highlights some inherent problems with using Tor without being careful.
Re:Identifying the user?? (Score:5, Informative)
To be specific, let me quote the spec [github.com]:
The current Cloudflare CAPTCHA simply places a cookie allowing you to access the website. Since Cloudflare controls the origins, it could currently correlate user sessions across multiple circuits using these cookies. This is a gap in the Tor Browser threat model- the design explicitly ignores linking within a session by malicious first parties, but Cloudflare has effectively first-party control over a large proportion of the web.
Our design is an improvement over this state of affairs. Since the CAPTCHA service only sees blinded nonces, Cloudflare cannot link a CAPTCHA solution session to a given redemption request. Since each token is used only once, in contrast to a cookie, the tokens themselves cannot be used to link requests.
Re: (Score:2)
In other words, they could have just used a cookie. But instead, they're making their own cookie system because they don't think Tor should even have cookies. This is good.
I just hope they contribute it to the Tor standard and release the plugin unbranded rather than just as a "Cloudflare enabler."
Re: (Score:2)
I agree. I think they are making an honest and competent attempt to solve the issue for Tor and that is excellent news.
Thanks for the link!
Re: (Score:2)
you can still correlate those nonces, yes?
Solve Capcha get nonce
use nonce at site A
use nonce at site B
use nonce at site C
At site A you divulge the nonce and component 1 of your identity
at site B you divulge the nonce and component 2 of your identity
at site C you divulge the nonce and component 3 of your identity
across sites A:C you divulge a larger set of your writing style than at only one by its self.
Third party actor (not cloudflare) can use this to build your session info into an ID of you; assuming t
Re: (Score:2)
From Wikipedia:
In cryptography, a nonce is an arbitrary number that may only be used once
You're given multiple nonces for solving one CAPTCHA [github.com].
Re: (Score:2)
Because it wants to blind the token.
NSLs don't work that way. Even the DOJ doesn't claim they can do that with an NSL.
There is, of course, a risk in running any code. But in this case one assumes they'll publish the code.
Re: (Score:1)
one should always be careful using anything, as sjw infested, as western intelligence infested, and as quick to jump to convictions without proof or crime, as tor now is.
Re: (Score:2)
It is user-tracking, sure. Anonymous user-tracking though. And if it works per-session, it is an acceptable solution IMO, as you can just restart the Tor-browser before going to a different site. Not great, but a lot better than nothing.
Re: (Score:2)
or, just don't install the extension.
Re: (Score:2)
Indeed.
Re: (Score:2)
Half of the people who're paranoid about this sort of thing don't even bother to use Whonix, which (with a snapshot on VB, or after they fix it to be a proper DispVM on Qubes) doesn't force you have to mic
Re: (Score:2)
Blinded. Token.
Learn some crypto and go read the proposal.
Re: (Score:2)
In that case, you shouldn't trust Tor itself, since it relies on a terrific amount of equally complicated crypto and other code.
Tor. (Score:4, Insightful)
If nothing else, this is just another confirmation that the modern web isn't set up to allow you to be anonymous.
That's a problem we techy types should be fixing, not encouraging solutions that identify the user even more.
Re: (Score:2)
Problem: Easy anonymous access for legitimate users allows easy anonymous access for malicious users.
Solution: ?
The problem isn't necessarily technical so much as it is psychological. To quote one of the Batman movies, some people just want to watch the world burn.
Re: (Score:2)
Read what they propose. You may have to learn some math first.
Re: (Score:1)
Re: (Score:1)
Do you have any idea how tor works? The exit nodes specifically don't know where the end points are, you need ISP/NSA level monitoring to correlate flows.
Re: (Score:1)
Re: (Score:1)
Yes, I do. Exit nodes know where the next hop is, obviously, but not the end point.
Calm down, climb down, and admit you were wrong.
Re: (Score:2)
I posted the same at first, but it looks like they avoided the low-hanging fruit. They could have just used cookies - which tor browsers accept just the same as any web page. They're actually proposing a more anonymous standard, and trying to close the cookie security hole.
Re: (Score:3)
They mean that the browser will be able to generate one time codes for each web site, not use the same code multiple times.
https://github.com/cloudflare/... [github.com]
"In this document we detail a protocol that enables a user to complete
a single edge-served challenge page in return for a finite number of
signed tokens. These tokens can then be used to bypass future
challenge pages that are served by participating edge-providers. The
Re: (Score:2)
People who benefit from anonymity:
- Political Radicals
- Privacy Averse (Really, there aren't many that care, and you aren't changing their minds fast enough)
- Trolls / Illegal Activity / blah blah
People who benefit from identity:
- Soft hearted hate-troll haters
- Oppressive and not-so oppressive governments (and their law enforcement)
- Pretty much every notable web company making money off your info/reputation
People that don't give a fuck:
- Everyone els
Re: (Score:3)
First category could include:
- Rape victims seeking advice online.
- People who are being stalked by their ex, or eye-witnesses to crimes, who might have someone kill them if they find them (sure, they could live their entire life offline in perpetuity, but that's just as oppresive)
- Political dissidents
- People who publish honest things about oppressive regimes (e.g. Salman Rushdie)
- You, writing this post, hoping that your employer doesn't find that story about him being a shithead last month.
- Some guy in
Nonces? (Score:1)
, the browser extension will use nonces (one-time authentication tokens)
Couldn't they have come up with a better name one that doesn't evoke "Kiddy Fiddler"
Re: (Score:2)
Actually, "nonce" is a longstanding English word meaning a single specific moment. It survives in common usage in the phrase "for the nonce".
Re: (Score:2)
No, me too. It's a common phrase in the UK to describe pedos.
Re:Nonces? (Score:5, Informative)
This is a technology site. Regardless of any UK slang most Slashdotters have never heard of, a nonce is a very standard word [wikipedia.org] in the world of security/cryptography.
One connection per domain problem (Score:3)
The problem here is that the TOR browser does one separate circuit per domain. So if you visit site A through TOR and have to solve a captcha because of cloudflare, and then visit site B, your IP will be different, and you'll have to solve a captcha again. AFAIK this problem only surfaced (doing captchas for every cloudflare site) when TOR adopted that behaviour. Before, everything was routed through one circuit, and you only had to fill in one captcha.
Re: (Score:2)
You just load the Javascript for the CAPTCHA all from the same Cloudflare domain, and it gets a third-party cookie that identifies you everywhere.
What they actually did was implement a standard and a browser extension that improves on the security of third-party cookies, and are effectively encouraging them to be completely disabled within Tor.
Re: (Score:3)
They also haven't read the source code for Tor or for Firefox or for the OS they're running all of it on. Package it with Tor and it's no worse than the rest of the TBB. In fact Cloudflare is trying to do it as an RFC so you could have multiple independent implementations.
Re: (Score:1)
Two words: bullshit and trust.
Presentations of things and deliveries of them are not the same, especially if there is government interest. Call me a conspiracy theorist, I don't mind a bit, but I don't trust anything that's taken a hit (government seizing control of "Tor'ed" servers to pick prey) being different in the future, and that's just the tip of the iceberg; since someone did it, others have the idea that it's a great way to use it for that purpose.
Look, spammers don't follow RFC standards when the
Or, just skip those sites. (Score:2)
I'm not especially inclined to bother with a site when Cloudflare shoves a captcha in my face not just to create and account or make a post; but to view its front page in the first place. My "One more step" is nearly always my browser's "back" button. Cloudflare can take their precious snowflake of a half-assed CDN and bite my shiny daffodil ass.