<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><div style="direction: inherit;">We already started that filtering approach. It's live for millions of web sites (although not all sites using Cloudflare) and has been for some time. It has resulted in a large drop in the use of CAPTCHA.</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">I was waiting to report to this group the results as I wanted to let it run for a while so we can see how well the abuse filtering works. But it's just fine that you mention is now. </div><div style="direction: inherit;"><br></div><div style="direction: inherit;">I'm very interested in the problem of filtering abusive Tor traffic because the Tor system is unique in its approach to privacy making it a challenge to filter well. This is an interesting engineering problem and has great benefits for us as being good at filtering abusive traffic from Tor makes us better at filtering abuse from the wider internet. </div><br>John.<div><br></div></div><div><br>On 8 Oct 2016, at 00:17, Mike Perry <<a href="mailto:mikeperry@torproject.org">mikeperry@torproject.org</a>> wrote:<br><br></div><blockquote type="cite"><div><span>John Graham-Cumming:</span><br><blockquote type="cite"><span>On Tue, Oct 4, 2016 at 4:15 AM, Jeff Burdges <<a href="mailto:burdges@gnunet.org">burdges@gnunet.org</a>> wrote:</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><blockquote type="cite"><span>On Mon, 2016-10-03 at 20:28 +0100, John Graham-Cumming wrote:</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><span>1. Benign GET / repeated 1000 times per second. That's a DoS on</span><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><span>the server</span><br></blockquote></blockquote></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><blockquote type="cite"><span>Are these serious concerns? I suppose they're more serious than the DoS</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>concerns, so that sounds bad from the token stockpiling perspective.*</span><br></blockquote></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Yes, these are serious concerns. If they weren't I would have just dropped</span><br></blockquote><blockquote type="cite"><span>CAPTCHA for Tor exit nodes and be done with it. We know from watching</span><br></blockquote><blockquote type="cite"><span>attacks come through Tor that to do so would expose people's web sites.</span><br></blockquote><span></span><br><span>Hey John, at the CloudFlare Internet Summit, we spoke briefly about your</span><br><span>efforts to work on a WAF-based approach for actively filtering out</span><br><span>obviously bad requests, letting through obviously good requests, and</span><br><span>then using this blind signed token scheme for the requests that were</span><br><span>difficult to tell for whatever reason.</span><br><span></span><br><span>I am still convinced that this combination (or something like it) is the</span><br><span>winning solution here, especially given what Georg pointed out about it</span><br><span>being difficult for us to store tokens for very long (depending on user</span><br><span>behavior, New Identity usage, and if they want to store disk history or</span><br><span>not). On top of that, with concerns about token farming/hoarding and the</span><br><span>need to expire keys/tokens somewhat frequently on CloudFlare's side, I'm</span><br><span>not seeing a terribly high multiplier/CAPTCHA reduction for the tokens</span><br><span>by themselves.</span><br><span></span><br><span>But I still do see a potentially high multiplier effect if we can do</span><br><span>better on request filtering, and also add the crypto on top of that,</span><br><span>even if the Tor Browser defaults work against us somewhat.</span><br><span></span><br><span>It sounded to me like you folks were really close to the WAF approach</span><br><span>working. Can you say if that is still the case, and what timelines we</span><br><span>might expect?</span><br><span></span><br><span></span><br><span>P.S. I hope I'm not stealing your thunder by talking about that project,</span><br><span>but I know it made me a lot less skeptical of the blind token idea as a</span><br><span>whole, and I suspect others here would also be comforted by that news as</span><br><span>well. Knowing that general trajectory would help everybody get closer to</span><br><span>being on the same page with this, I think :)</span><br><span></span><br><span></span><br><span>-- </span><br><span>Mike Perry</span><br></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>tor-access mailing list</span><br><span><a href="mailto:tor-access@lists.torproject.org">tor-access@lists.torproject.org</a></span><br><span><a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-access">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-access</a></span><br></div></blockquote></body></html>