10

CloudFlare's captcha screen appears more and more often during Tor browsing. First they ask for a CAPTCHA and that's ok. Then there's the copy/paste confirmation string. That should be the last obstacle, but instead I'm back again to the same screen, re-doing it in an endless loop, that is quite frustrating. I'm not alone with it; there are others with the same problem.

Not only are they invading our privacy in a much worse way than normal trackers do (certainly much more difficult to block), they also make it impossible for us to freely and flawlessly surf the web!

CloudFlare and all the similar services are the new-generation of trackers: with the excuse of being protective against all kinds of DoS attacks, they are quickly conquering a very big slice of the internet! And whenever you try to visit a site that they serve, your request will go straight to them first, and therefore logged and shared too. There is no way to block this unless you avoid visiting all the websites it serves, of which there are quite a lot actually....

I feel like the usability and user-experience of Tor browsing is exponentially decreasing due to these kinds of issues. Has anyone else noticed this problem with CloudFlare? What do you think about it, and what the solution could be?

Improve this question
10
  • Could you please add some example(s) of sites with the described problem? You can also probably add how did you try to block them a why the blocking is difficult.
    – pabouk - Ukraine stay strong
    Oct 18, 2013 at 19:33
  • Completely rephrased the entire post. @pabouk, they are quite a lot. Just to do a couple of examples, network-tools.com & nbcmiami.com
    – MrX
    Oct 18, 2013 at 22:12
  • Here's somebody with the same problem as mine: webhostingtalk.com/showthread.php?t=1290351
    – MrX
    Oct 18, 2013 at 22:24
  • 1
    I run into CloudFlare challenges occasionally. It's happened with both Tor and VPN services. I even used CloudFlare once, as it was bundled with hosting. It's rather analogous to Google CAPTCHA, which I encounter far more often using Tor. Some sites just totally ban Tor, VPNs and other known proxies. It's all just a consequence of associating with jerks ;) The only practical solution is getting a new IP address and moving along. Using either Tor or VPN services to get a base IP address, you can install your favorite proxy switcher, and download HMA's free proxy list.
    – mirimir
    Oct 19, 2013 at 1:01
  • 1
    OK, let's say that you're using Tor Browser Bundle (TBB). Just install an HTTPS proxy switching add-on in Firefox, and get the free "anonymous" HTTPS proxy list from HideMyAss. Add a few fresh proxies to the proxy switcher. If you run into a CloudFlare block, try using some of the proxies. If that doesn't evade the block, two possibilities come to mind: 1) the website or CloudFlare blocks HMA proxies too; and 2) CloudFlare has tagged your computer in some persistent way that TBB didn't prevent.
    – mirimir
    Oct 21, 2013 at 4:08

3 Answers 3

Reset to default
9

CloudFlare challenges are based on the Security Level chosen by the site owner. Higher protection levels mean more users are likely to be challenged (usually by filling in a CAPTCHA to proceed).

Site owners also get to set a Challenge Passage TTL to "specify how long a visitor is allowed access to your site after successfully completing a challenge". The shorter this TTL, the more often risky visitors will have to complete a new challenge. Unfortunately, due to Tor's automatic rotation of exit nodes it could be the case that it's less an issue of CloudFlare's TTL as of your jumping to a new risky IP every ten minutes.

CloudFlare themselves appear to have a more hands-in-the-air-not-our-problem attitude and point users to contact the site owners if they've been blocked entirely.

You're completely right saying "whenever you try to visit a site that they serve, your request will go straight to them first". CloudFlare in particular have full control over who gets to land on one of their sites due to their setup process which requires them to control the site's DNS as well as proxying all site traffic. They're not just a CDN for static content, and in fact their T&Cs specifically forbid usage as such.

If you continue to have problems then it's probably worth contacting the site owner and letting them know that they're putting off users because of the security setting they have in place with CloudFlare. If enough users raise the visibility of Tor browsing as a legitimate avenue to their site then hopefully they'll either adjust their settings or move to a platform that will be more anonymity-friendly.

Improve this answer
1
  • 1
    Then how do we contact StackExchange to make it easier to access using Tor browser. It is probably the worst offender from my vantage point. So bad that I only access it using Firefox without Tor activated.
    – ron
    Feb 4, 2016 at 0:00
2

This is another assault on privacy and anonymity, from my perspective. It's analogous to the NSA indiscriminately collecting (everyone's) communications because there are a few bad guys they want to catch. CloudFlare is a middleman that answers only to their corporate profits at the end of the day. It's a central storage for every surfer's IP address and the sites they access. It doesn't take much imagination to see why so many consider this a far from innocuous development. Personally, as someone who regularly comments via Tor on blogs known for alternative perspectives, I feel threatened by CloudFlare and its browser fingerprinting algo-methodology. The only way site owners might be persuaded to care about the privacy of its contributors more than their own (disproportionate) desires for elusive bullet-proof security (wholesale trust in CloudFlare?) is for their loyal base to revolt by declining to enter the captcha and avoiding the site property altogether. That's my answer to the ever increasingly gated internet. In the near future, it won't be worth paying for any sort of fenced internet connection. Until then, it's resistance, not sheepish obedience.

Improve this answer
2

To minimize influence of such trackers:

  • write captcha in search box (or elsewhere) then paste it into CAPTCHA input. I guess in case the operator CAN record speed of typing text to identify the user.

  • to protect against browser fingerprinting (check out Panopticlick by EFF) try this firefox addon: Random Agent Spoofer

    • randomizes reported screen size and depth (manual install of addon needed for this option)
    • randomizes browser profile, timezone etc
Improve this answer

Not the answer you're looking for? Browse other questions tagged .