1

This question came after seeing CloudFlare captchas, forums outright banning Tor IPs to protect themselves from malicious traffic, and all manner of hurdles where sites simply don't want Tor traffic.

This gave me a theoretical question - if everyone was using Tor, and sites couldn't distinguish between users based on IP, how would they protect themselves from spam and malicious traffic? Would they simply have to accept that there is nothing they can do?

Or would it be in such an alternative reality world that you need to enter a captcha for every site you visit?

I found some similar questions, such as How to protect against DoS but not harm Tor users and How to best help site operators protect themselves from Tor based abuse?, but I believe that mine is a little different because I'm curious what would be done in a theoretical scenario where everyone uses Tor, so blocking it is not an option.

Improve this question
5
  • I would think that it would be up to Tor developers to prevent DoS, by implementing some kind of statistical analysis to prevent clients to send too many request/second.
    – Irving Poe
    Nov 11, 2014 at 15:11
  • But then the exit node faces the same problem - it can't identify the origin of the traffic, because it goes through 5-6 other nodes, right?
    – sashoalm
    Nov 11, 2014 at 15:51
  • I was thinking about the entry node doing the filtering, because the entry node knows the origin of the traffic. But there may well be issues as the one you mention on the entry node too.
    – Irving Poe
    Nov 11, 2014 at 15:57
  • @sashoalm Always 3 nodes per circuit (no more, no less), unless you're connecting to a hidden service in which case two circuits are essentially chained together (or you manually construct a longer or shorter circuit).
    – user5
    Nov 11, 2014 at 21:29
  • I think for the purpose of answering his question we can also assume that we're not looking for protocol or application level changes on the Tor network. He seems to want to know what site operators themselves could do.
    – user5
    Nov 11, 2014 at 21:30

1 Answer 1

Reset to default
1

There are 2 kinds of malicious traffic:

  1. Traffic that is the same as 'normal' traffic, but the amount/volume makes it malicious. [D]DoS. (I don't really have an answer for this one.)
  2. Traffic that has been crafted to trigger and exploit bugs in the server software or host OS.

For the 2nd kind, now that the easy semi-fix of blocking IPs doesn't work anymore, because you would lose your entire audience, you're forced to go the more difficult, but more worthwhile route of addressing those bugs (or if they have already been addressed, keep your servers patched).

By the way: In your theoretical scenario, all web sites could be hidden services, so that exit nodes would no longer be used. Then there is really nothing to block anymore. Sadly, I'm sure there would still/again be something like CloudFlare what runs distributed banks of hidden services that use their own introduction points.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .