commit ae31484c9b429b1f8b06c1869a6417a99b67f596 Author: Pili Guerra pili@piliguerra.com Date: Tue Feb 4 12:02:58 2020 +0100
Update GSoC CF project details --- .../gsoc/cloudflare-captcha-monitoring/contents.lr | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/content/gsoc/cloudflare-captcha-monitoring/contents.lr b/content/gsoc/cloudflare-captcha-monitoring/contents.lr index 332ca2a..dbdc7e4 100644 --- a/content/gsoc/cloudflare-captcha-monitoring/contents.lr +++ b/content/gsoc/cloudflare-captcha-monitoring/contents.lr @@ -15,46 +15,47 @@ color: primary key: 1 --- languages: +python javascript --- mentors: GeKo, arma --- difficulty: medium --- -title: Cloudflare Captcha Monitoring +title: Cloudflare CAPTCHA Monitoring --- subtitle:
-This project should implement a mechanism to track the rate that Cloudflare fronted webpages return captchas to Tor users over time. +This project should implement a mechanism to track the rate that Cloudflare fronted webpages return CAPTCHAs to Tor users over time.
--- body:
# Problem
-A large number of Tor users report getting hit by infinite captcha loops when visiting webpages fronted by Cloudflare. This makes them feel punished for using Tor to protect their privacy and prevents them from legitimately accessing websites. +A large number of Tor users report getting hit by infinite CAPTCHA loops when visiting webpages fronted by Cloudflare. This makes them feel punished for using Tor to protect their privacy and prevents them from legitimately accessing websites.
# Proposal
-For this project we would like to track in practice how often Cloudflare fronted webpages return captchas to Tor clients. +For this project we would like to track in practice how often Cloudflare fronted webpages return CAPTCHAs to Tor clients.
Our proposed approach consists of:
1. Setting up a very simple static webpage to be fronted by Cloudflare -2. Write an application which small client to periodically fetch this static webpage via Tor and record how often a captcha is returned -3. Record and graph captcha vs real page rates +2. Write a web client to periodically fetch this static webpage via Tor and record how often a CAPTCHA is returned +3. Record and graph CAPTCHA vs real page rates 4. Using the pre-existing architecture, run a second client that does not fetch this webpage via Tor. This will allow us to contrast and compare how Cloudflare responds to Tor Browser vs other browsers. 5. Track and publish these details publicly
There are two interesting metrics to track over time:
-- the fraction of exit relays that are getting hit with captchas, and -- the chance that a Tor client, choosing an exit relay in the normal weighted faction, will get hit by a captcha. +- the fraction of exit relays that are getting hit with CAPTCHAs, and +- the chance that a Tor client, choosing an exit relay in the normal weighted faction, will get hit by a CAPTCHA.
Then there are other interesting patterns to look for:
- Are certain IP addresses punished consistently and others never punished? -- Is whether you get a captcha much more probabilistic and transient? +- Is whether you get a CAPTCHA much more probabilistic and transient? - Does that pattern change over time?
# Resources