tor-access

tor-access@lists.torproject.org

2 participants
12 discussions

Re: [tor-access] Predicting effectiveness
by Alex Davidson 04 Oct '16

04 Oct '16

> If this becomes an issue, there is an approach that might work : Just > use multiple signing keys, one system wide key C for all CloudFlare > sites, and individual site keys for each site CloudFlare protects. If > you solve a CAPTCHA then you withdraw a moderate stack of C tokens. If > you visit site X then you spend an X token if you have one, but if you > do not then you spend a single C token to withdraw tens of thousands of > X tokens. So solving a CAPTCHA is worth hundreds of thousands of page > loads, but only across a moderate number of sites. We could've separate > Cbig and Csmall keys such that first it withdraws with Csmall, but if > the users blows through that quickly then it withdraws with Cbig. The spec already accounts for this by giving out a single-domain cookie to any client that successfully redeems a token. We'd need to figure out how long these cookies last for (a day perhaps?), but the idea is that the client would no longer need to redeem any more tokens for that domain. Each token effectively guarantees you access to a resource for the given time period. Because of this we have reduced the number of tokens that should be handed out. For example in the original spec 10,000 tokens were talked about as a reasonable amount whereas in our implementation we use somewhere between 100 and 1000. In our implementation we struggled to work with more than 1000 tokens without rendering the browser complete useless for a fairly long time period anyway, since the extension has to verify and unblind each of the tokens it receives. Alex

1 0

Welcome to the tor-access mailinglist!
by Mike Perry 20 Sep '16

20 Sep '16

Howdy everyone, Welcome to the tor-access mailinglist. This mailinglist is meant to be a semi-moderated forum to engage in solution-oriented discussion about ways to address issues that users have while using Tor (and similar shared-IP systems) to access websites - particularly CloudFlare sites, but also any other major site or provider that currently limits access from Tor for various reasons. If you're getting this mail, you should be able to post to the list freely. Others may also subscribe, but their posts will be held in moderation until we decide to whitelist them. The list archives are public. The list is only moderated so we can prevent it from degenerating into the counter-productive flamewars that have happened elsewhere in these discussions. I intend to be fairly liberal with adding new folks to the discussion, and if everything seems to go smoothly, I will likely turn off moderation entirely. I'm hopeful that as we make progress on these issues, all of that pent-up frustration from seeing one too many captchas will evaporate, and everyone will be much happier to work with eachother :). We've also got a fairly good initial selection of friendly people here: several Tor folks, CloudFlare folks, EFF folks, friendly cryptographers, and other allies are already subscribed. Here's to a positive solution to these issues, and a more accessible Internet for everyone! -- Mike Perry

2 1