A call to arms: Helping Internet services accept anonymous users

by arma | August 29, 2014

Looking for a way to help the Internet stay open and free? This topic needs some dedicated people to give it more attention — it could easily grow to as large a project as Tor itself. In the short term, OTF's Information Controls Fellowship Program has expressed interest in funding somebody to get this project going, and EFF's Eva Galperin has said she'd be happy to manage the person as an OTF fellow at EFF, with mentorship from Tor people. The first round of those proposals has a deadline in a few days, but if that timeframe doesn't work for you, this problem isn't going away: let us know and we can work with you to help you coordinate other funding.

The problem

We used to think there are two main ways that the Tor network can fail. First, legal or policy pressure can make it so nobody is willing to run a relay. Second, pressure on or from Internet Service Providers can reduce the number of places willing to host exit relays, which in turn squeezes down the anonymity that the network can provide. Both of these threats are hard to solve, but they are challenges that we've known about for a decade, and due in large part to strong ongoing collaborations we have a pretty good handle on them.

We missed a third threat to Tor's success: a growing number of websites treat users from anonymity services differently. Slashdot doesn't let you post comments over Tor, Wikipedia won't let you edit over Tor, and Google sometimes gives you a captcha when you try to search (depending on what other activity they've seen from that exit relay lately). Some sites like Yelp go further and refuse to even serve pages to Tor users.

The result is that the Internet as we know it is siloing. Each website operator works by itself to figure out how to handle anonymous users, and generally neither side is happy with the solution. The problem isn't limited to just Tor users, since these websites face basically the same issue with users from open proxies, users from AOL, users from Africa, etc.

Two recent trends make the problem more urgent. First, sites like Cloudflare, Akamai, and Disqus create bottlenecks where their components are used by many websites. This centralization impacts many websites at once when e.g. Cloudflare changes its strategy for how to handle Tor users. Second, services increasingly outsource their blacklisting, such that e.g. Skype refuses connections from IP addresses that run Tor exit relays, not because they worry about abuse via Tor (it's hard to use Skype over Tor), but because their blacklist provider has an incentive to be overbroad in its blocking. (Blacklist providers compete in part by having "the most complete" list, and in many cases it's hard for services to notice that they're losing contributions from now-missing users.)

Technical mechanisms do exist to let anonymous users interact with websites in ways that control abuse better. Simple technical approaches include "you can read but you can't post" or "you have to log in to post". More complex approaches track reputation of users and give them access to site features based on past behavior of the user rather than on past behavior of their network address. Several research designs suggest using anonymous credentials, where users anonymously receive a cryptographic credential and then prove to the website that they possess a credential that hasn't been blacklisted — without revealing their credential, so the website can't link them to their past behavior.

Social mechanisms have also proven effective in some cases, ranging from community moderation (I hear Wikipedia Germany manually approves edits from users who don't have sufficiently reputable accounts), to flagging behavior from Tor users (even though you don't know *which* Tor user it is) so other participants can choose how to interact with them.

But applying these approaches to real-world websites has not gone well overall. Part of the challenge is that the success stories are not well-publicized, so each website feels like it's dealing with the question in isolation. Some sites do in fact face quite different problems, which require different solutions: Wikipedia doesn't want jerks to change the content of pages, whereas Yelp doesn't want competitors to scrape all its pages. We can also imagine that some companies, like ones that get their revenue from targeted advertising, are fundamentally uninterested in allowing anonymous users at all.

A way forward

The solution I envision is to get a person who is both technical and good at activism to focus on this topic. Step one is to enumerate the set of websites and other Internet services that handle Tor connections differently from normal connections, and look for patterns that help us identify the common (centralized) services that impact many sites. At the same time, we should make a list of solutions — technical and social — that are in use today. There are a few community-led starts on the Tor wiki already, like the DontBlockMe page and a List of Services Blocking Tor.

Step two is to sort the problem websites based on how amenable they would be to our help. Armed with the toolkit of options we found in step one, we should go to the first (most promising) site on the list and work with them to understand their problem. Ideally we can adapt one of the ideas from the toolkit; otherwise we'll need to invent and develop a new approach tailored to their situation and needs. Then we should go to the second site on the list with our (now bigger) toolkit, and so on down the list. Once we have some success stories, we can consider how to scale better, such as holding a conference where we invite the five best success cases plus the next five unsolved sites on our list.

A lot of the work will be building and maintaining social connections with engineers at the services, to help them understand what's possible and to track regressions (for example, every year or so Google gets a new engineer in charge of deciding when to give out Captchas, and they seem to have no institutional memory of how the previous one decided to handle Tor users). It might be that the centralization of Cloudflare et al can be turned around into an advantage, where making sure they have a good practices will scale to help many websites at once.

EFF is the perfect organization to lead this charge, given its community connections, its campaigns like Who has your back?, and its more (at least more than Tor ;) neutral perspective on the topic. And now, when everybody is sympathetic about the topic of surveillance, is a great time to try to take back some ground. We have a wide variety of people who want to help, from scientists and research groups who would help with technical solutions if only they understood the real problems these sites face, to users and activists who can help publicize both the successful cases and the not-yet-successful cases.

Looking ahead to the future, I'm also part of an upcoming research collaboration with Dan Boneh, Andrea Forte, Rachel Greenstadt, Ryan Henry, Benjamin Mako Hill, and Dan Wallach who will look both at the technical side of the problem (building more useful ideas for the toolkit) and also the social side of the problem: how can we quantify the loss to Wikipedia, and to society at large, from turning away anonymous contributors? Wikipedians say "we have to blacklist all these IP addresses because of trolls" and "Wikipedia is rotting because nobody wants to edit it anymore" in the same breath, and we believe these points are related. The group is at the "applying for an NSF grant" stage currently, so it will be a year or more before funding appears, but I mention it because we should get somebody to get the ball rolling now, and hopefully we can expect reinforcements to appear as momentum builds.

In summary, if this call to arms catches your eye, your next steps are to think about what you most want to work on to get started, and how you would go about doing it. You can apply for an OTF fellowship, or we can probably help you find other funding sources as needed too.

Comments

Please note that the comment area below has been archived.

Thanks! I hope somebody

Thanks! I hope somebody picks this up and runs with it! It's a very important topic that needs attention from smart people.

Back in 2013 I had been a

Back in 2013 I had been a viewer of slashdot for years. Then I decided that either I wanted https for pages, or Tor, or better both. Slashdot did not provide https and was blocking Tor (you got to see the first page and then it started blocking). So, I moved to reddit where I get both. Vote with your feet, as they say.

Right! But I bet Slashdot

Right! But I bet Slashdot had no idea how to quantify the number of people jumping ship because of its lack of https, or jumping ship because of how it treated Tor users.

So if they start out assuming that people who care about https / people who use Tor are jerks who bring no value to the site, they could easily conclude "good riddance" and never know what they're now missing.

That's where the social science aspect of this topic comes in: how do we quantify what Wikipedia is losing when it chooses to discard the perspective of people who care about privacy? Until we have ways to answer questions like that, we'll be stuck in a "you're missing out!" "screw you no I'm not" circle.

(Wikipedia is also interesting here in that some places in the world censor access to Wikipedia, and then Wikipedia in turn censors those users when they show up via Tor.)

Wikipedia doesn't realize

Wikipedia doesn't realize how they are shooting themselves in the foot. The Wikimedia Foundation's status as a nonprofit does not obscure that their "business model" is "user-generated content". Yet without stopping to consider how much they depend on the generosity of faceless nobodies, they exclude contributions by anonymous nobodies.

I frequently get the urge to fix or contribute something on Wikipedia. Usually it's a matter of typos or grammar, or perhaps the addition of a reference. Occasionally, I see an opportunity to add substantial text on a topic I am well-qualified to address. But Wikipedia's anti-Tor policy gently reminds me that perhaps I really shouldn't contribute unpaid time, effort, and brains to their glorious informational empire.

I am proud to use Tor; and if I want to volunteer, I prefer to do so where I am wanted. As such, I actually thank Wikipedia for signalling me that they do not value my potential contributions.

i can only second that. just

i can only second that.

just as anon said above they lose many contributions (wikipedia) or customers/revenue stream (other sites). mine, too!

so, this project can really benefit the internet community.

thanks, arma!!

I used to be a prolific

I used to be a prolific Wikipedia editor, and their anti-Tor policy had always rankled me. In fact, Wikipedia's anti-Tor policy is how I learned about Tor (and nine years later they're still shooting themselves in the foot).
Many years ago one user was nominated for adminship, and would easily have gotten it until a "checkuser" revealed that s/he had sometimes used Tor to edit, and because of that, had no hope of ever becoming an admin, which goes to show how stupid their policy is. They are shutting out so many great editors, including from China and Iran.

(slashdot aborter): Apart

(slashdot aborter): Apart from my belief that this is an excellent project, developing a way to inform site owners about *why* people leave (the different categories, https, tor etc.) may be one of the best things to come of it. For that is influence.

how do we quantify what

how do we quantify what Wikipedia is losing when it chooses to discard the perspective of people who care about privacy?

I think this is an excellent way to phrase the question.

Beyond simple IP-based blocks, I've found countless bugs in projects on code.google.com for which I'd love to contribute a bugfix/workaround/description, but I'd need a Google ID (implying cellphone verification) to do that. Too bad.

My latest problem in my

My latest problem in my battles after having my google compromised over and over is exactly as you stated - cellphone verification which would further compromise my safety. Add to that my particular need to change my pw so frequently that I finally locked myself out due to user error (I didn't commit the final one to memory or write it down) during the middle of a divorce AND the 2-step verification process. My phone disappeared and hence, my main 8+ year of files, etc google account was deleted after 4 months since I could not sufficiently verify that I was in fact, the owner of my own account. By now due to a stalking issue, I have a ridiculous number of gmail accounts that I've opened and not ever returned to lest I compromise myself further or lest that be one of the main ways I'm being tracked... I can't pretend to have the knowledge that my stalker does as global IT director of a major corporation.

By now I'm so used to constantly losing data and electronics that the only reason I care much about the same old song and dance is that what I want most is to be able to log into my last youtube account. However, that requires me to open a google account which in turn requires me to provide a phone number. I have reached a point that I won't carry a phone with me due to the whisper mode listening in not to mention the GPS tracking though I'm certain there's one on my latest vehicle due to recent events. It seems I cannot get new electronics protected fast enough as he now gets in so quickly that it makes me dizzy - I can't cover all the bases I even know about before he's already infiltrated my brand new electronics and tools. I'm at a loss but this time around I'm using TOR which I only knew about due to SR and never considered it for more legitimate needs to actually ensure my ongoing ability to live - much less have any peace.

I found this page because one of the ways he was getting in a couple of years ago was with fake captchas that used most scripts from google except for one that when I looked at the source, went to a non-google site. It became apparent when I'd not enter the captcha that said I could not use google if I didn't - but if I closed out the window and reopened, I could move forward. The older ruses were more easily recognizable.. the google and yahoo captcha trick reeked of sloppiness as far as the logos being slightly out of focus AND I recognize the font he uses which after years ago managing a site together, I recognize his design work.

Since I'm not too familiar with all the ways I can use TOR to help this situation, I've checked too many unknown to me options in the settings. Tons of search strings or sites I try to access have a google-based captcha that looks archaic but I think that's because i have scripts, java, flash mostly off as I'm getting my bearings.

I guess it's a good thing I cannot access saving playlists in youtube since every time my last PC and set of email accounts are rendered useless due to sabotage, I lose my access to those playlists. SO this has made me begin to do what I should have been doing all along which is to create a local file collection of music. Obviously that makes more sense and then my media can be accessed without ever getting on wifi or the net at all which is where I'm headed after almost two decades of this BS. Seriously, I'm near the point, despite being a CIS major and making my last living via PC... and despite it becoming my practically only meaningful socialization since this abuse has me in complete isolation - I'm about to wash my hands of technology and that's a shame as it's essential, what I love and my mainline to the world -
like most other people here, I'd venture to assume.

I wish I could help in your cause. Even though I stumbled upon this trying to ease my mind on the captcha situation, what you wrote is powerful and compelling. I really have enjoyed all comments I've read so far and if I had the means, this is a cause I could dedicate myself to due to what I've gone through so that perhaps others might never fall victim to such abuse in the first place.

No matter what the reason, every person has a right to personal privacy and thus freedom. It's simply appalling how it seems our society is moving away from the true intent of democracy. It seems once the information age became a reality and the global community united, it has fed government control and increasingly powerful laws and agencies that look almost like we are headed toward a police state. Some of these umbrella laws give the powers that be the ability to incarcerate or otherwise take away constitutional and human rights of a person for seemingly any reason that can be fabricated.

I know I'm way off topic. As I've watched the net propel us forward at the speed of sound and open up the world to anyone with access, it seems to be feeding all the loss of personal freedom by those in the highest ranks who have the power to take away our rights. That's just how it seems to me when I recall the days that they told us one day we'd talk to people on the other side of the earth in real time and how it'd make the world united and a collective consciousness. It was fascinating to watch unfold. I remember the first company for which I worked that allowed the internet to your average worker made me cringe thinking of all the loss of productivity I envisioned as left unchecked, I imagined the vast majority of the mediocre masses wouldn't do any work but simply surf the net all day.

It seems that no one knew what to expect or what would truly unfold so quickly that it made the Internet seem like a mysterious and dangerous force - which seems to have made the power of the Internet a threat to those who wield power over the masses which consists mostly of people who were the most resistant to the Internet and prone to resisting the rapid changes, unwilling to learn new things and not willing or able therefore to see the benefit. In my own experience, unfortunately the Internet is a dangerous weapon that is being forged against me. I can only still wonder what comes next as things continue to unfold.

Thanks for your story. One

Thanks for your story.

One note of caution -- if the way your stalker is getting to you is by running spyware on your computer, then Tor won't be able to help you as much as you want. Tor assumes that the computer it's on is safe, and the network it's using is unsafe. If the computer is unsafe too, there are far fewer options for keeping your privacy.

Good luck!

yeah I'm just sick by now.

yeah I'm just sick by now. It seems to me that as long as my GPS location is known there's no escape from years of experience making my known location even when I try to run obviously known. The saddest thing is the statistical outcome for victims who were in my position in a study of only 6 months of terrorism were one of 3: suicide, homocide or complete abandonment of technology. I can't deny that after all these years I haven't changed into a person who thinks of all those things or a combination of them on a daily if not multiple times per day. I just can't escape and if I even call a number I've ever called before - that gets me. I can't warn every person I meet to remove the battery from their phone before ever coming within so many feet of me.., it's an unreasonable and irrational request by all appearances to really anyone who hasn't been living through this. Denial kept me blind and thus so far behind in what seems to be an ever accelerating game when all I really seem to be able to do is obsess and say to self, why can't we just have peace. It's like a twisted, sick mockery of Groundhog Day. Thanks for commenting. I'm trying not to lose all hope or sanity but there's no doubt it has taken a huge toll on me. I feel totally powerless and as far as all I've tried to do - that seems to be actually completely true. I guess one good thing came out of it - I'm no longer lacking a Higher Power and relying on it constantly. I guess it takes what it takes. I just wish I could make it stop because I truly wish no harm to anyone. I don't wish to expose what only I know and I pose no threat if that's the object - to eliminate me as a liability. It goes so far beyond that, though since it's sociopathic and falls into Antisocial Personality Disorder as the core Axis I disorder. I can't pretend to understand that side of the obsession and compulsion but I do take responsiblity for my part and now my total OCD on the opposite end of the spectrum. I couldn't see it even though it was so obvious due to complete denial until I could no longer ignore it. It feels like an unstoppable sequence of events that won't end well. Aside from not wishing to due any harm, only wanting to have a chance at peace for each of us, the reality is that when I did try to seek LE assistance, I was falsely arrested a year ago and then the exact same thing just happened so I'm still reeling. Both times my place - different places were broken into and all electronics stolen aka evidence. I'm starting to realize he is incapable of stopping and now I'm under community supervision. I mean it was so obviously a set up just like last year but last year it was all dropped and I heard whispers of an IA investigation. They just wanted it to go away. This year LE began hassling me days in advance and somehow knew exactly where I would be and at what time. I'm just reeling from sitting in county jail and now being under total supervision and unable to run - well I could - for the next 3 years. I feel so screwed which I'm sure is the point. Anyway, I'm so sick of it but can't stop trying to figure out any way out making mistake after mistake further burying myself. It's just tragic. I never have really shared about it as I feel it's all being read anyway but at some point I have to talk to anyone, even anonymously as far as everyone but the perpetrator is concerned. You know wish in one hand and ____ in the other and see which one gets full first comes to mind. It serves no purpose for me to talk about it, I don't think. I don't know. Anyway, thank you. I appreciate that someone even heard me. =)

It seems to me that if a

It seems to me that if a website,whomever it may be,that will not allow a user to access their site,that is blatant DISCRIMINATION! NOT ALLOWING FREE WILL,unless its on there terms.

Since I believe in direct

Since I believe in direct action I decided to mail admin@wikitravel.org the following letter some months ago. wikitravel.org is blocking all tor exits from viewing content.

"Hy,

I noticed that wikitravel.org does not load when viewed from the Tor
network. Tor is a privacy and anonymity network used by many different
people, sometimes because they are being censored. For more information,
see TorProject.org.

Wikipedia has chosen to block all Tor users from editing its pages, but
users can still load and view wikipedia pages. It is unfortunate to see
that WikiTravel has chosen to block every connection to the Tor network
outright. WikiTravel also does not support HTTPS, which further
complicates privately viewing a WikiTravel webpage.

Would it be possible for WikiTravel to unblock Tor users from viewing
the website, but e.g. only block them from editing pages?

Kind regards,
A Tor user."

The next day I received the following reply from aleksandra.wocial@internetbrands.com :

"Hello,

thank you for your email. I send today a request to our Tech team asking about it. I will let you know once I hear from them.

Warm regards,

Aleksandra Wocial
Online Community Specialist
InternetBrands.com"

I have mailed her one time since asking if she would get back to me but haven't heard from her.

Since they (InternetBrands and Wikitravel) have not made public what consideration they give to Tor users, maybe we should collectively ask/mail them in order to get this issue on their radar. I suspect that Wikitravel doesn't realize they are blocking Tor, and that they would prefer to let Tor users read (not edit) their site.

Yep. Part of what we need to

Yep. Part of what we need to do is a) reach out to actually make and sustain a social connection with this 'tech team', to help them understand what the issues are and why they should care, and at the same time b) try to get a handle on what blacklisting infrastructure they use, in case as you say they don't even know they're doing it.

Luckily, this particular

Luckily, this particular problem became moot when WikiVoyage effectively superseded WikiTravel.

Great! I had not seen this

Great! I had not seen this before.

I think, Tor should adopt

I think, Tor should adopt the ORB mechanisms of the UKUSA services. No hacking, but if a website blocks Tor, have a repository of open, "anonymous" HTTP/HTTPS/SOCKS proxies, attach one of them and forward the traffic from the exit node to them. The only way for me to go to some .mil sites is to choose an open proxy from one of the known lists and forward the Tor traffic with Privoxy.

That leads to further steps

That leads to further steps in an arms race that I'd rather not play. Once we start taking tips from spammers on how to not get censored, we shift the perspective that people have about us, which could end up making these conversations with the service admins less productive.

Also, there's a scalability / usability question here that is (independently) tough to tackle.

Typo? "[...] Cloudflare et

Typo? "[...] Cloudflare et al can be turned [...]"

Hm? No, I think I meant it

Hm? No, I think I meant it as is?

didn't knew it

didn't knew it before
https://en.wiktionary.org/wiki/et_al.

Adv. et al. - and others

Adv. et al. - and others ('et al.' is used as an abbreviation of `et alii' (masculine plural) or `et aliae' (feminine plural) or `et alia' (neuter plural) when referring to a number of people); "the data reported by Smith et al."

We're running a Tor relay

We're running a Tor relay ourselves, but our money-making website blocks all Tor access because we were heavily hit with abusive scraping over Tor that couldn't be blocked differently.

I don't see a practical solution currently, it's not justified for us to keep buying/running more servers just to keep up with abusive accesses over Tor. Perhaps it would be useful to build client-side rate limiting into Tor, so abusers would at least have to put some effort into manipulating their client ...

When I visit websites that

When I visit websites that use Cloudflare using Tor, I often have to enter a captcha before I can view the site. After I have done this once, I can browse the site freely for the rest of the session. This seems like a sensible way of dealing with the problem of scraping.

This cloudflare-page appears

This cloudflare-page appears regularly on reddit, but I can't see the captcha.
Am I missing something?

From my experience, it would

From my experience, it would seem to require JavaScript.

This is a recent problem

This is a recent problem with the Google ReCAPTCHA API. Instead of properly serving a ReCAPTCHA image, it redirects you to a standard Google captcha challenge page, breaking the HTML.

I agree -- so far so good

I agree -- so far so good with Cloudflare. But all it takes is one really bad day for the engineering team at Cloudflare, and they might pick a different balance. Now is a great time to establish a relationship so they know who to contact when that bad day starts.

(Also, web services care about scraping for different reasons. Some of them just don't like the extra load that it brings, so a captcha or the like is a fine solution. But others are scared that their competitors will "steal" all of their data. This worry is even true for really big companies like Google worrying that Bing will steal and reuse their search answers. And they could justifiably worry that just sticking a captcha in the way won't dissuade Bing from doing its crawling.)

I disagree: Not so good

I disagree: Not so good with Cloudflare. I have observed that when I access a Cloudflare customer's site for the first time in a session, I am almost never blocked; it doesn't seem to matter which exit node I am using; this behavior is opposite that of most other block services, which seem to run on simple IP blocks. But if I click a few more links and/or browse other Cloudflare-ified sites in the same session, I suddenly hit either a captcha or a page telling me to enable JavaScript. If I immediately restart with a clean session (via Tor Browser's "New Identity" button or equivalent), the cycle repeats.

I have not (yet) attempted to rigorously quantify the behavior; and some of my inferences about cross-site tracking may result from coincidence. (Attention all researchers...) But this basic pattern does appear very consistently. Note too that the behavior I describe occurs when I am only passively reading, not posting to forums or the like.

From the foregoing, I infer that:

Cloudflare uses either cookies or some kind of "supercookie" to track sessions, perhaps cross-site and perhaps not.
Cloudflare's motive in this context cannot be the prevention of abuse. Assume the opposite: For very normal websurfing behavior on my part to match an "abuse" signature, Cloudflare's engineers would need to be face-palm, head-to-desk caliber stupid. I absolutely do not think they are stupid; q.e.d.
Cloudflare is deliberately coercing me via "nudge" psychology to either abandon Tor or enable JavaScript. The former offends my privacy, and the latter offends my security.

I suspect that the disabling of JavaScript is the real issue. This raises the question: Why should I trust Cloudflare, trust their captcha provider, trust the site I am trying to access, and trust all that site's third-party ad/widget/button services? Worse still, why should I open myself to the in-the-wild MITM attacks documented via Edward Snowden? Keep in mind, Tor users per se are deliberately targeted[1] for increased surveillance and potential compromise.

The only reasons I can imagine are the twin monsters of advertising and user profiling. Both are bad reasons, and issues in and of themselves. As to Cloudflare, I would appreciate if they would clarify whether they are in the anti-DDoS/anti-spam business, or they are in the business of manipulating me to violate security best practices so I can have more spam ads poured down my throat. Note, I do not take any measures to block simple, same-origin HTML ads.

[1] ["NSA targets the privacy-conscious", Appelbaum et al., 2014-07-03]( http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html )

I can only second that! I'm

I can only second that!

I'm pretty much in the same situation, so you saved me some typing, thanks!

one minor nitpick, though:
""Cloudflare is deliberately coercing me via "nudge" psychology to either abandon Tor or enable JavaScript. The former offends my privacy, and the latter offends my security.""

the latter (enabling JS) offends BOTH your privacy AND security:

https://panopticlick.eff.org

try it twice: once with and once without JS: you'll see that you're much more trackable with JS

Question about Cloudflare

Question about Cloudflare and enable JS for Captchas: Can the Website see my real IP if I enaable JS so I can enter the Captchas? Thanks.

Without a separate vuln in

Without a separate vuln in TOR, no. However, as evidenced by the recent CP busts (To be blunt: I do not download CP nor do I look for it), you cannot be sure that there is not a separate vuln so the best thing to do is to absolutely disable Javascript period.

" Cloudflare's engineers

" Cloudflare's engineers would need to be face-palm, head-to-desk caliber stupid. I absolutely do not think they are stupid..."

I disagree.

I may be wrong but their operating philosophy suggests to me that they are face-palm stupid ..... or perhaps they are simply too full of themselves. I've witnessed this type of conduct a number of times over the years in programming and IT.

http://google.com

Well, that's exactly the

Well, that's exactly the sort of thing that we as a community need to investigate further. Maybe there are easy rate limiting mechanisms that can be integrated into many standard server-side configurations? Or inserting enough captchas, or making people login, or requiring their account to have sufficient reputation, or using the anonymous credential systems I describe, etc.

In short, it's the "that couldn't be blocked differently" part that I question. I'm not saying you're doing your job badly, but I think nobody's looked at this area enough to be able to make definitive statements like that one, and it sure would be nice if we could make some of the solutions I described more intuitive and easier to deploy.

Tor could indeed do the client-side rate limiting you describe. In fact, we could do rate limiting per circuit at the exit relays. But I'd much rather have an application-level solution to the application-level problem, rather than furthering the assumption that so many people have that network addresses are the right level for doing abuse control.

I'm a bit confused about the

I'm a bit confused about the statement

a growing number of websites treat users from anonymity services differently. Slashdot doesn't let you post comments over Tor, Wikipedia won't let you edit over Tor, and Google sometimes gives you a captcha when you try to search

since it is followed by

Simple technical approaches include "you can read but you can't post" or "you have to log in to post".

which seems to condone what was condemned at first.

Also, are CloudFlare and Akamai doing anything to hinder Tor users from the sites they are protecting? Or is the article merely referring to the possibility.

Well, those simpler

Well, those simpler approaches are way better than doing nothing at all, but I'd sure like to see some solutions for the Slashdot and Wikipedia cases that don't involve keeping those sites read-only for Tor users.

Cloudflare sometimes inserts captchas, and sometimes just gives back failures, but from what I can tell most of the time it works smoothly. I don't know if those are accidents and they notice and fix them, or if they're accidents and they don't even notice, or what.

I've talked to some of the Akamai engineers -- they're all about scalability and laugh at the idea that the load from Tor could be a big deal compared to the load they already see from the rest of the Internet.

So in that sense the centralization is a good thing so far, since it means these larger companies actually have engineers who think about the issues and try to find the right balance.

how about hiding the list of

how about hiding the list of exit nodes so tor cannot be blocked? you could give them to clients like you do with bridges. i guess it would take away some of the safety features for exit node operators. but what would you do if your_dictatorship_country decides that instead of blocking connections from clients to the tor network, they could just block connections from tor exit nodes to servers inside their country?

I'm pretty sure that nobody

I'm pretty sure that nobody would be prepared to run an exit node if they were secret. In any case, tor clients need to know where the exit nodes are so that they can build circuits to them.

Most censors are primarily concerned about their own people viewing banned sites, they don't care about foreigners viewing local sites.

The problem is that the

The problem is that the users need the list of exits to be able to choose the exits to route through. This is needed for anonymity reasons otherwise the person who told you about the exit can possibly correlate traffic from that exit to you.

Currently, the Tor Project does provide a list of exits which some blacklist providers probably block. But, it is probably best to continue doing this as some of the blacklist providers might create their own Tor blocking methods if this list disappeared. And if that happened, a mistaken implementation might block traffic from the middle nodes too, harming access for those relay operators (assuming they run their relay from the same IP they use for other traffic).

So, it is probably best that the Tor Project maintains this list. Besides, it is also a good way to maintain community relationships because developers have an easy way to block Tor if it is causing a problem rather than being victimized by anonymous traffic. Also, this list is critical for enacting mitigation on a selective basis (i.e., being able to view but not post).

https://www.torproject.org/do

https://www.torproject.org/docs/faq#HideExits

One point that many people

One point that many people seem to miss is that the Tor Project has a social policy agenda intertwined with the technical one - and the former supports the latter. This is indeed the reason for Tor's greater level of success versus other well-known (or less well-known) anonymity systems. A feedback loop is formed between the non-clandestine nature of the network, TPO's promotion and advocacy of responsible network usage, and the provision and expansion of the network itself. (Somebody should write a paper on this, and credit me as "Anonymous".)

Some people need a deeper level of anonymity (rigorously stated: an anonymity set larger than and/or disjoint to "all Tor users"). This remains a difficult problem except, unfortunately, for criminals who are willing and able to use compromised systems. Non-criminals who want or need anonymity don't currently have too many good choices besides Tor.

Agreed.

you are wrong: We can't help

you are wrong:

We can't help but make the information available, since Tor clients need to use it to pick their paths. So if the "blockers" want it, they can get it anyway. Further, even if we didn't tell clients about the list of relays directly, somebody could still make a lot of connections through Tor to a test site and build a list of the addresses they see.

you are wrong. you can hand them out like you do with bridges. enumerating them will be hard.

If people want to block us, we believe that they should be allowed to do so. Obviously, we would prefer for everybody to allow Tor users to connect to them, but people have the right to decide who their services should allow connections from, and if they want to block anonymous users, they can.
Being blockable also has tactical advantages: it may be a persuasive response to website maintainers who feel threatened by Tor. Giving them the option may inspire them to stop and think about whether they really want to eliminate private access to their system, and if not, what other options they might have. The time they might otherwise have spent blocking Tor, they may instead spend rethinking their overall approach to privacy and anonymity.

if you give people the possibility to block tor they will do exactly that. they have no reason to care or think about anything. the number of tor users are not enough. also this does not answer
but what would you do if your_dictarorship decides that instead of blocking connections from clients to the tor network, they could just block connections from tor exit nodes to servers inside their country? ("your_dictarorship" got stripped out because it contained some special characters)

right, at least allow access

right, at least allow access through the Tor only - use hidden service. don't simplify enemies life, force them use Tor.

TOR should try to get

TOR should try to get support from big companies like Google and others to run relays or offer their services from inside the TOR network. With backup from big businiss things should go easier especially if it comes to politic topics.

So TOR needs a special Team to mobilize support from big corporations. Perhabs Banks (If you tell them that TOR is a good way to secure theit internal communications against attacks).

Google and banks run relays

Google and banks run relays and services inside the network?
No free lunch.
Toroogle network anonymity anyone?

Except it wouldn't be a good

Except it wouldn't be a good way to secure their internal communications, it would be passing their internal communications around globally. While they might be encrypted, it's safer to use an alternative that doesn't expose secure data at all.

While logical, I can't say I

While logical, I can't say I agree at all. Being eventually bought out by google - or partnering for what is essentially a monopoly like the coupling of eBay and PP while highly profitable only invites hidden agendas and corruption which while individual criminals may utilize the TOR network, that is nothing in comparison to the what I feel is sneaky business practices and big money simply eliminating and taking over the competition. TOR is a beautiful thing and by now, I pretty much believe google is in cahoots with the NSA despite their claims. Again, conspiracy theory but after so many years of them collecting data and never purging it, surely there is something more sinister at work. Corruption is rampant at any corporation if you are privy to it and/or pay close enough attention from the inside - it's simply the way things are. Money breeds money and the classes (lower, middle and upper) never seem to change.

I can't speak for the success of user based funding and what once made Wikipedia a remarkable venture with all contributors feeling a valuable part of the project... yet I along with everyone else couldn't ignore when they began begging for donations.

One idea could be a subscription based enhanced TOR for at least future users since you'd not want to take anything away from those who have been here all along and would want to quietly grandfather them in if TOR made some feature available through a nominal fee... unless some added feature that was highly desirable could be offered as a Pro version versus the ever free version.

Back to making it more of a social movement, costs could logically go down with the more willing to piece meal some of the work utilizing their individual talents for the simple reason of feeling a part of something special. If google or yahoo or any majorly commercial giant asked me to do their work, I'd be appalled. Yet if I could help something I value as I do like TOR, I wish I knew how to help. The loyalty factor and being part of something people really need and covet goes a long way. Even if it's not nearly as fast or clean so far for me, I value the concept over those slight annoyances. My interest in TOR pretty much cancels out any frustration as I understand it's an evolving system with capabilities that make using it invaluable.

It will sell itself now that people are worried about their privacy since the lack of privacy can no longer be denied. I think it's simply a matter of getting the word to everyone using the RIGHT approach. How to present it other than just the original and go to best option for proven and invaluable private internet usage is what I think will be a decisive factor. Then again the privacy factor alone might be everything that it takes to bring the numbers.

which one of the pluggable

which one of the pluggable transports is the fastest?

don't you think you should

don't you think you should add an other jop with meek? because google logs everything they would be logging the client's ip, its first hop (google) and the middle node, and that's a lot of info for someone in bed with the 3 letter agenciesss

You should assume everyone

You should assume everyone logs everything on the internet, not just Google, and every major internet corporation will turn over their logs if their government pays them enough. Of course, your ISP has the same information. The goal of meek is to allow users that cannot directly connect to TOR for a variety of reasons to use TOR. There is a cost to that, just like all of the other pluggable transports. That's also part of the reason they aren't enabled by default and you have to turn them on.

That is precisely why third

That is precisely why third generation onion routing is not sufficient. It has fixed-length three hop circuits. Middle relays can see the entire Tor circuit! Once both the entry and exit are known, accessing their logs is trivial. A four hop circuit would make it so that no relay knows the IP addresses of both the entry and exit by shielding one of them with a two hop onion route.

No, I recommend that you

No, I recommend that you read the tor-design paper and other up-to-speed materials in more detail.

Yes, the middle hop knows the first hop and third hop, but he doesn't know who is using the first hop, and he doesn't know what destination is being accessed through the third hop.

So the middle hop doesn't know whether the given circuit is worth attacking or not. And, "once the entry and exit are known, accessing their logs is trivial" is not true for most or all adversaries.

For much more detailed reading, you might like the diversity discussion at
https://blog.torproject.org/blog/improving-tors-anonymity-changing-guar…

I have a simple idea how tor

I have a simple idea how tor users could have identities (plural - if I'm an activist, job seeker, and cancer patient - I deserve at least 3) that are accountanble (no way to impersonate). I know accountability can't stop a malicious user from inventing many "spam identities", but most service providers already have some basic new-user trust-management policy: from the wordpress "first comment is moderated" policy to elaborate ranking schemes forums have.

There's simple and well-tested technology for this: an OpenID provider behind a hidden service on the user's device (if I have several identities, each should have its own hidden service - to avoid unification/deanonymization).

This can't be done if you don't have tor/I2P (to run an SSL server, I need a certificate, and this requires deanonymization), but fits hidden services like a glove.

OpenID got "bad rep" [IMHO - intentionally - because it wasn't centralistic enough to be "profitable" in terms of meta data], but once you blow the PR smoke away, you'll notice that nothing's really "broken" with it. The standard was simply bullied out of existence (at least "practical existence" - you can't kill an idea).

Where would the first users login with their credentials?
The simplest solution is to also give users an "out of the box blog that is an OpenID client and runs on a hidden service".
Another option: a loosely-federated disqus-ish embeddable.

I'm no expert in people and lawyerts, but IMHO - regardless of how we plan to deal with a specific service provider we want to make "less tor hostile", it's easier to give them an API and say "we already have a standard, it's already in use and, has a developer community, let me show you some examples".

Just sayin'.

Yep. Mozilla's Persona

Yep. Mozilla's Persona system seems like a great building block here:
https://www.mozilla.org/en-US/persona/

And then assuming you get buy-in from various sites, you've changed the problem to "how do we prevent jerks from getting too many identifies on the persona server"? And that's a fine area to experiment more on.

IMHO, Mozilla did all the

IMHO, Mozilla did all the wrong things with their BrowserId/Persona: single provider [de facto. I know they had vague plans], and the initial assumption that I am a "single person" whether I'm acting as an activist, job seeker, or beaten wife. I do respect the Mozilla team - but IMHO BrowserId is yet another good intention to pave the road to hell with.

Today - at the age of massive meta-data collection - even "traditional OpenID" would have been a risk because it lets a 3rd party collect [a partial - but still] "login stream". A lot less risky as having a facebook account, but almost anything is ;)

On the other hand - the idea of client side OpenID servers hasn't been seriously tried so far - mainly because it only makes sense when users can run hidden [self-certifying] services.

Tor team is in the perfect position to push for such a standard (if you decide to do so):

You are the code distributors (and can [eventually] decide to bundle the server-side part with torbrowser/tails)
you happen to have the need (services don't trust tor users at the moment).

As for building blocks: the simplest would be to wrap https://github.com/yottatsa/ownopenidserver as a hidden service. It's a minimum-moving parts implementation (only has a single user), which is fine - since if I want 2 identities - I'll need them as 2 hidden services anyway.

Update: we're doing this

Update: we're doing this (not a "royal we". We'e plural "for real" :) )

https://github.com/hidden-id/hidden-id#readme

This idea looks

This idea looks interesting.

However I'm wondering if we can't do something more simple. Here, you are using a protocol that requires a reachable http server to authenticate you (openid), and you add a tor hidden service so that everybody can have a reachable http server. Could we do it using a protocol that doesn't require an http server ? Or am I missing an important feature provided by doing it like this ?

For instance, could we use PGP keys as identities ?
When you create your account on a web site, you give them a PGP public key. When you need to log in to the web site, you sign a message which includes a timestamp and the URL of the login page using that key to prove that you own the key (or a browser extension which has access to your keys do it for you).

This doesn't solve the problem of someone creating a few thousands keys for spam. But I think this problem can be solved separately. We could imagine some people hosting human verification services: you prove that you are a human by solving a few captcha on their website (or other methods), and in exchange they sign your key. Website owners can then require that you provide a key signed by one of those captcha service to create an account.

> Could we do it using a

> Could we do it using a protocol that doesn't require an http server?
I guess we could, but suppose we do it well enough and peer review it enough until it becomes as "reliable" as OAUTH2?
http://homakov.blogspot.co.il/2012/08/oauth2-one-accesstoken-to-rule-th… ;p

OpenID has been tried and tested. What killed it (except for commercial interests) was the fact the since Snowden's revealations we can no longer assume that different service providers aren't colluding (unless the provider is the user, of course).

The only known vulnerability [IMHO] of OpenID is only relevant if the service that requires the authentication (e.g. the blog) is over plaintext http (and since Snowden - we know that it shouldn't be ;) )
https://en.wikipedia.org/wiki/OpenID#Authentication_Hijacking_in_Unsecu…

Bottom line: I don't think it's prudent to try and compete with a protocol that has been peer-reviewed since 2005.

Even if we invest the amount of peer-review that has led to OAUTH2 (the current industry standard - which goes to show the sorry state of said industry), OpenID is a much more reliable alternative, and already has libraries for many popular platforms (e.g. a wordpress plugin).

Tor is creating second-class

Tor is creating second-class citizens on all networks where their users connect. The combination of failed "threat intelligence" filtering and constant abuse has led to a situation where blocking all Tor relays is preferable to the benefit provided by supporting these connections.

How does the Tor Project provide value to the service providers, who have to invest heavily into authentication (SASL, etc) to support what are predominantly abusive users, from their perspective?

I ask as a supporter of Tor, the EFF, and privacy in general.

Well, that's just the thing:

Well, that's just the thing: are they actually predominantly abusive users? A comment under this one, from one of those service providers, talks about how they make sure to keep Tor connections working because they recognize the value from Tor users. We have millions of users coming through Tor, and it's easy to underestimate how many that is. So your "from their perspective" phrase is a key one, and underscores how this issue is as much about advocacy and education as it is about technical changes.

Then the flip side is that Tor isn't actually the primary source of abuse to these sites. Botnets, open proxies, etc are also a problem, and they're much harder to block:
https://www.torproject.org/docs/faq-abuse#Bans

So to me it seems hard to sustain the "I have to block Tor, because otherwise I'd have to figure out how to handle abuse on my website" argument -- you're going to have to figure it out anyway because of all the non-Tor jerks out there.

As more and more users

As more and more users prefer using Tor, the websites eventually will have to open up to Tor more. There will be power in numbers. Isn't it a matter of time?

Also, can you help improving Tor user's reputation without introducing the undesirable Tor censorship? If Tor could block spam in an ethical way, there's be less problems.

Consider a mail relay analogy. If it allows relaying spam, there is not much can be done to improve its reputation, but to stop relaying spam. No educational campaigns and no begging would do.

:"As more and more users

:"As more and more users prefer using Tor, the websites eventually will have to open up to Tor more. There will be power in numbers. Isn't it a matter of time?"

I think there has to be a mass advertising or some sort of way to get the word to the people. I would have NEVER known about TOR if not for SR. And no one I've ever met has even heard of SR or TOR. Maybe that's changed but if no one knows something much more secure and offering much greater privacy as what people are finding they lack, then there would be a mass of newly enlighted new users who had no kinowledge of such an option. With ongoing discoveries by the pubic of cell phone, email and other monitoring whether it be by the prolific malware or stalking software so readily available much less the consensus that the NSA is listening in growing by the day in the name of controlling 'terrorism', surely comes safety in numbers. The more that are informed of the invaluable service, naturally TOR will expand and become eventually the standard. Then again, I'm sure tons of copycat browsers perhaps with much more financial backing would start to propagate with the growing need. So TOR has to be the best, perhaps lacking advertising or something that sets it above the rest, I'd think. Yet if it's a movement created basically for the people by the people - a grass roots movement might be the ticket since people want change and like to feel they are an integral part of it - whether it's the .. (check this out for off hardly a short non-related change of terminology I just happened across: http://www.outlawsmcworld.com/onepercenter.htm) Occupy Wallstreet movement that waxed and waned, the Anonymous and Project Synergy that just lacks any real organization, IMO or any other uprising against the systems in place. If the cause isn't radical or extremist, if it's warranted and does a much needed service I can't imagine that once the general public knows of it's existence that it won't naturally grow in epic proportions as the word spreads. Just my thinking and I don't know much. =)

Even if we buy the

Even if we buy the "predominantly abusive" fud, how can it explain (for example) cloudflare making a user go thru a captcha (and a google one. grrr) all the time?

It doesn't seem like a benign attempt to defend against attacks. Cloudflare read-only static urls are exactly that: read-only and static. You can't "attack them by looking at them" (maybe DoS falls under that definition, but I find it hard to believe cloudfare are having serious DoS problems via tor exit points. Am I missing something here?).

What cloudflare does, seems (at least to me) like a "hint" to admins using their services: we're in it for the metadata your users produce. If tor users are important to you (i.e. your "business" model can't simply say "screw tor users"), you're a "freeloader" and we ask you to take your "business" elsewhere.

Correct me if I'm wrong (and there's some other reasonable explanation to this). I think the problem is not that tor users can't be trusted. It's just that in today's "business ecology" (which is a nice word for surveillance), tor users aren't "profitable" enough :(

The way that these services

The way that these services handle TOR is not at all surprising when you consider the amount of attacks that are levelled against these services everyday. You land on a page from a TOR exit node, and you have to realize how many bot nets have bounced through that node to hit them. Serving a captcha is small potatoes, and Cloudfare aims to be a bottleneck, so that they can handle these attacks so that their clients don't have to.

TOR is a great service that does great things, but anonymity comes with a price. No identy means no trust, and if you can't see why that must be, then you're being willfully blind.

I work on one of these teams mentioned specifically and, believe me, TOR is actually given preference over a random IP, because we know that there is good mixed in with the bad. If we got the amount of abusive traffic from a home IP that we get from any TOR exit node, we'd just serve them 403s and be done with it.

Thanks for this perspective.

Thanks for this perspective. I'm glad you've been able to find a good balance so far. Please feel free to reach out to us if you have any Tor questions we can help with! :)

But while I'm here, I'd like to push back on one of your phrases -- Tor is about separating the application-level data from the network-level address. It's not about "no identity". By default Tor users don't broadcast their network-level address, and then they can decide how much to reveal about themselves when talking to the destination site.

So for example it makes perfect sense to ssh somewhere over Tor -- you really do want to authenticate that you're talking to the right server, and it really does want to know that you're the right user, but there's no need to tell somebody watching your network connection where you're going, or to tell somebody watching the server's network connection where you are that day.

So in fact it is totally reasonable for a website to require authentication before providing a service. I just want to live in a world where that authentication doesn't rely so heavily on network-level identifiers. (And while I can argue that increasingly you won't be able to rely on them anyway, given the number of compromised computers out there, etc, I can't really argue that they're not useful for today's heuristics. But wouldn't it be cool if we had better application-level solutions, so we're more prepared for this future?)

Oh, and I guess I should also throw in a vote against the centralization of identity in the form of the increasingly popular "please give me your facebook login to see this unrelated content". So many components to get right at once!

WTF? Ian Clarke's blog[1]

WTF? Ian Clarke's blog[1] blocks some/most/all Tor exits. Please, somebody advise the original creator of Freenet[2] that his personal blog cannot be accessed via the world's most successful anonymity network.

Also, the blocking service is ioerror.us (allegedly registered to Michael Hampton in New Hampshire, United States[3]). Does Jacob Appelbaum[4] (better known as "ioerror"[5][6][7]) perchance have a trademark?

[1] http://blog.locut.us/
[2] https://freenetproject.org/
[3] http://whois.net/whois/ioerror.us
[4] https://www.torproject.org/about/corepeople.html
[5] https://blog.torproject.org/blogs/ioerror
[6] https://twitter.com/ioerror
[7] https://github.com/ioerror

Sure enough. It's probably

Sure enough. It's probably some default configuration for his blogging platform, which passes off all the users to ioerror.us which in turn passes them on to projecthoneypot.org. So not only is it a hassle here, it's also a massive privacy leak where all these different organizations get to see all your users (ok, to be fair, we're losing that game on multiple fronts due to like buttons, adwords cookies, etc).

Maybe a way forward is to identify some blacklisting companies that do handle Tor addresses well, and then we'll have a more useful action to suggest to folks like Ian?

arma said, "Sure enough.

arma said, "Sure enough. It's probably some default configuration for his blogging platform..." Exactly my point!

In my experience, a polite explanatory note to the owners of small sites usually elicits one of two responses:

Courteous (even apologetic) reply: "I'm sorry, I didn't even know!" Although this response is encouraging, the site owner often needs to file a support ticket with his or her service provider. If such is the case, the prospects are gloomy. Providers themselves need to be educated, which in turn requires organized advocacy.
Condescending brush-off: "Go away, you paranoiac", and/or some variation of the classic "If you don't have something to hide..." Sometimes with the implication (or accusation) that I must want to do something abusive on their site. Well, it's their site and their opinion, versus my time and effort. I just move on.

Context: I route all my Internet usage through Tor. Not many people do this. In recent months, the increasing frustration level has given me a good excuse to turn off the computer, go outside, enjoy real life a bit more---so there are upsides, sort of. Consider this some "Tor user feedback" on the topic of the post.

The privacy leak you mentioned is also one of my major concerns. I'm surprised (but not really) that few people seem to notice this. This issue is one of many as for which technical countermeasures may exist, but a comprehensive solution requires advocacy.

So in sum, thank you for this "call to arms". There are many pieces to this puzzle, some of which should perhaps be raised on the mailing lists. In the interim, this post to Tor blog brings focus to one of the key problems inhibiting Tor usage today.

P.S.: I have not (yet?) tried contacting Mr. Clarke myself, for reason of another problem facing Tor users: Increasing difficulty of obtaining a free, unlinkable short-term-use account from a decent e-mail provider with a sufficiently large anonymity set. If I can spare such an account, perhaps I will use it to raise the issue and potential solutions on tor-talk.

https://www.openmailbox.org

https://www.openmailbox.org - reload if it shows a blank page - and https://bitmailendavkbec.onion are popular(ish), Tor friendly, and the sign-up is real quick.

Sorry, the .onion link

Sorry, the .onion link should have been regular http: http://bitmailendavkbec.onion

"Context: I route all my

"Context: I route all my Internet usage through Tor."
I and my family access ALL websites only through Tor too. If site is paranoid and don't wont you - don't use it. They always have something to hide.

hey thanks! thats a good

hey thanks!

thats a good motto, didnt think about it previously!

Site owners, step back and

Site owners, step back and see some other perspective. Do you really want that you put work to make your site, SEO sleaze it up to get the traffic, obsessively look to your stats, then make angry the visitors that are smart enough to disable Javascript and too busy to interrupt flow and fill out stupid CAPTCHA every few minutes? Hint, you are not the only website on the entire internet.

Cloudflare is a bad offender, so do not mistake: Cloudflare doesn't use only the ridiculous CAPTCHA. Sometimes, it just throws up the page commanding me to enable Javascript. I don't see why I should be risking my security, to allegedly protect theirs. Remember, overwhelming majority of code execution browser exploits (including most 0days) need the Javascript functionality. The person that surfs with Javascript engine running, is either smart person with zero computer skill (doctor, lawyer...) or just plain stupid. Worse, after all Snowden revelations, the Tor user that surfs with Javascript must be suicidal!

Any website which throws me the CAPTCHA gets 90% chance I will ignore, move on. Newsflash, your site is not so special. There are millions of others. CAPTCHA is irritating, and every new visitor is like you are on a first date. You irritate me before you even say hello, you are rude; good bye, you lost even the chance I may get to know you. Any website which demands Javascript to view static content gets 100% chance of the Control-W, with extreme prejudice.

Cloudflare customers are at least fortunate, the Cloudflare Javascript wall is not frequent. It seems, I hit it 1-2 times per the week. So, Russian roulette for the site owner. Other sites/"protection services" demand it all the time. *plonk* I actually start to be using this as a signal of site quality, to save me the time.

"Do you really want that you

"Do you really want that you put work to make your site, SEO sleaze it up to get the traffic, obsessively look to your stats, then make angry the visitors that are smart enough to disable Javascript"

I'm afraid that the number of such users, as a percentage of the total number of internet users, is so small as to be statistically insignificant to most JavaScript-dependent sites. I could be wrong, but I would imagine that this would remain true even if one would combine all JavaScript-adverse users and all Tor users, as well as users of VPNs and other proxies.

Yes, number of such users is

Yes, number of such users is very small. But I implied too, quantity != quality.

This may be of no consequence to site for (say) badly spelled captions on cat photos. But any site addressing serious or productive topics, surely treasures connection from the kind of people that disable the Javascript.

By analogy, number of PGP users is very small. Greenwald learned the hard lesson, when he wasted months ignoring Snowden's request to establish a secure communication. He was lucky, Poitras knew better.

I'm going to have to say I

I'm going to have to say I disagree. Although most of the sites I do visit aren't forums, many have extremely limited functionality without javascript. Inquiring about fixes doesn't yield significant improvement given that there's also a drive to maintain a up-to-date website. Javascript isn't an optional component of the modern web like it was ten years ago. There are vast sections that simply don't work without it, because there are things you simply can't do without it (or without something worse.)

Besides, a larger TOR userbase means better anonymity, and most of those people need features provided by Javascript. According to Yahoo! developer, only about 2% in the US have JS disabled and that's above the world average. Limiting TOR to the highly technically inclined who don't use the majority of the internet isn't a good path toward increased anonymity.

I think the anon above you

I think the anon above you didn't mean to say that tor should be restricted to non-JS users.
rather the opposite: the web admins should be aware that these 2% non-JS users exist, and 2% != 0%

for example, if you run a webshop, and you measure, let's say 1.3% non-JS users, then you should consider whether the additional expense for an alternative (perhaps CSS-based) site design is less then 1.3% of your sales profit.
if yes: then you should definitely do it.

personally I'm convinced that many businesses could actually profit from being more privacy friendly, they just need some assistance to get started/aware of the problem.

Am I the only one who thinks

Am I the only one who thinks we should be complaining about Mozilla and Google rather than site providers, pertaining to the "JS required" issue? Website providers shouldn't have to worry about what vulnerabilities they are exposing their visitors to by requiring JS, and neither should the users. Of course, it's easier to say "Mozilla, Google, make your JS engines more secure" than it is to do it, but I see that as no excuse to to ignore the underlying source of the issue, nor to throw it between site providers and users to fight about.

First hide the Tor traffic

First hide the Tor traffic from Wikipedia, I've done it simply using another CGI anonymous proxy that's not TOR at all. Simply running anonymox plugin over Tor browser, that alone disguise my Tor back in 2008. I don't know about recent development lately, however I think the Tor user can use torbundle to reach online anonymous or elite proxy and from there the Tor user can connect to the other websites. So far I have no problem with google or other if I use saveIP or expatshield to proxified my connection. Although I'm not use my portable Tor bundle directly connected to those VPN, but it still work for me. The point is to make your Tor id hidden. That's it. So far other network that hath reject TOR, sometimes I use open ID proxy aka transparent online proxy before I connect to wikipedia should I decided to edit my postings on that site. Cloudflare, yes it's a problem, but the key is simple, hiding your TOR behind other online proxy. Back draw is this method is slowing down your connection. One other thing I once taste Advance TOR but this one also conflict with flash players, etc. That's the bug that needed to be fixed ASAP and also the Advance Tor only use sock port 9050 and not 9150 . This one can run all traffic through TOR but I hate their bugs a lot, so I hope TOR developer here can bring something like the Advance Tor could bring.

Two things. One, having a

Two things. One, having a VPN connected *after* the exit node is a bad idea. It may be acceptable for short term usages if you really have to bypass traffic (I use anonymouse.org for that), but it is not secure, and over only a short amount of time, it can build up a profile on you. Second, I don't think you should trust AdvTor. They may have good intentions, but it's not nearly as heavily audited, and has some nasty security bugs that are long fixed in the official Tor versions.

What nasty security bugs in

What nasty security bugs in AdvOR?

Im sure

Im sure Startpage.com/Ixquick.com could not only be a partner to discuss Google Captchas affair but probably way more. e.g. Ixquick proxy serves Yelp to Tor users.

Yeah, and searching for an

Yeah, and searching for an URL via Startpage and then using their proxy link in the result often works.

True, thats a current

True, thats a current workaround for viewing most pages.

Probably the Tor Browser team could add a function ("Button" oder "Addon") for viewing current page via ixq Proxy. Maybe it could be combined with or added to the "security slider": https://trac.torproject.org/projects/tor/ticket/9387

There doesn't seem to be an

There doesn't seem to be an API for the Ixquick proxy, you really have to search for an URL to get its (long, opaque) proxy link

Tor Browser could resolve

Tor Browser could resolve Tor denying page to same page via proxy. Probably such a "addon" would require constant maintenance. But if there would be a userbutton with ckeck-field if this page can be reportet as Tor denying you shure would get a long list really fast.

can you give us the link for

can you give us the link for the orfox apk please? the links posted in the previous post are very confusing me

Thank you for addressing

Thank you for addressing this.

I used to have an account on Craftster.org, an Internet Brands site. I opened it before IB bought them and posted for years, but they started refusing logins over Tor a few months ago so I have not been back even to view pages. They may be a good company to start with as sites like this are very dependent on user-generated content and the problem seems easily solved by modifying existing procedures: they already moderate comments and require a comment history before starting threads or posting photos. Unless they have switched their revenue model entirely to trafficking in personal data, it is hard to imagine that blocking seasoned account holders merely because they do not drag a trove of such in with them would make sense.

Another possibility is craigslist, which I understand is particularly troubled by scammers of all sorts but which has gone overboard by banning any connection from a known Tor IP outright. There should be options for anonymous viewing and for permitting users to create and log in to trusted accounts without sacrificing either party's security. They used to have the reputation for being pretty smart, low-bs people, so they might be more amenable than some other companies.

I don't know how or what exactly, but a public campaign of some sort, a way for individual users to tell these companies, "you have lost my business and this is why" when it happens might be helpful. A pop-up or button on the TorBrowser? An (anonymized) email campaign? Something that is hard to automate and looks more like civic participation than a DDoS attack would be good.

Again, many thanks to the Tor community for taking this up and for making Tor in the first place.

I think I could fill this

I think I could fill this role. I'm highly technical and an activist. Sounds fun.

Recently I have been blocked

Recently I have been blocked from commenting on a blog which uses sucuri.net and in another case I have been blocked from just viewing a blog page by another service.
I visited both blogs for the first time and tried different Tor IPs.
It was obvious that they block Tor as a whole.
Of course it was also the last time these blogs wasted my time.
Especially annoying is sucuri blocking which doesn't notify you until you try to send your comment.

But I think this is not really my problem. There is an ocean of blogs out there. Most try to get attention and advertising money. The only thing these blocking blogs are achieving is reducing their chance to get regular visits and comments from the, lets say, less shallow part of the web user base.

What I really would like to have is a Tor Browser extension which tells me upon visiting a page if they block comments from Tor IPs.
This would save a lot of people some time.
We could start the underlying data source for such an extension with a dedicated page where everyone can easily post Tor blocking URLs.

Another category are public services blocking Tor like some European Union sites. It should be possible to get this category resolved with reasonable arguments and supportive voices from the Tor community.

The only thing these

The only thing these blocking blogs are achieving is reducing their chance to get regular visits and comments from the, lets say, less shallow part of the web user base.

There was a Dilbert comic a while ago that had the Pointy-Haired Boss say, "We don't care what smart people think. There aren't that many of them."

About once a month I visit

About once a month I visit Yandex search engine and get a got laugh.

"Unfortunately, it looks like the search requests sent from your IP address are automated. Therefore, we've had to temporarily block your access to Yandex Search."

Come on. They like to compete with the big search engines
and you would think they wait on hand and foot for users willing to try them out. Who else is willing to try them as an alternative except some privacy minded folks turning their back on Google? So long Yandex until next month, maybe.

The topic of this post has

The topic of this post has been of concern to me for some time and I am pleased see it being addressed.

I must note, however, a certain irony to the timing of this post: It is the first to appear after a mysterious occurrence on this blog that began a week or so ago. All of a sudden, the two most recent threads that had been active stopped being updated with new comments and I found all of the 'reply' buttons replaced with log-in prompts. This would have been odd and disconcerting enough but to make it even more so, there did not appear any link or pointer toward somewhere where someone could even create such an account to log-in with. (As of this writing, neither the original 'reply' buttons nor the sudden log-in buttons seem to be present in the threads in question.)

During this time, I regularly checked both this blog as well as the online archive of the Tor-Talk mailing list (Update daily; https://lists.torproject.org/pipermail/tor-talk/ ), hoping to see some explanation or even just /mention/ of this sudden change on the Tor blog but I could not find a single mention thereof on either site.

https://trac.torproject.org/p

https://trac.torproject.org/projects/tor/ticket/12949

https://lists.torproject.org/pipermail/www-team/2014-August/thread.html…

This blog is on its last legs. Or maybe it's better to say that its legs got removed years ago. Hopefully we'll have a better one someday soon.

Thank you for the prompt

Thank you for the prompt reply.

Wouldn't it have been a good idea to announce the change right here on the blog?

Any chance of getting obfs4

Any chance of getting obfs4 Pluggable Transport listed in the Tor Metrics Portal > Users > Bridge users by transport? I'm using Yawning Angel's experimental Tor Browser 4.0-alpha-1 and I wonder how many other Tor users are using it. Obfs4 runs like a stable version on my computer, no problems I can find. Windows 8.1 Pro 32-bit.

For me the thing is very

For me the thing is very simple. If some Internet service for any particular reason - using a tor exit node, not using java or java script, not using that one browser they want me to use or the newest version or some plugin - does not want to serve me it's content, I am swiftly saying "bye, bye" and never looking back because I have no time while looking at the other options the Internet offers me.
This is the World WIDE Web. It is full of content and the choice is ours. If Facebook or Wikipedia does not want me to register and be a... well... a product they sell, it is fine with me. I can usually find free and open alternatives that serve my purpose.
Just my $0.02.

I share your sentiment in

I share your sentiment in principal but in the real world (or the real virtual world...) not everyone has the luxury that you apparently do. There are many people who sometimes, or even oftentimes, have a real need to access sites that, alas, block Tor and/or require JS, etc., etc.

I also think I could fill

I also think I could fill this role. Where should I get in touch if the OTF isn't working for me right now?

Chatting with Tor people on

Chatting with Tor people on irc is probably a good first step. And then putting together a proposal for the tor-dev list.

This one is tricky in that there are a lot of starting-up things to do, from building a plan for what technically you'll do, to finding a group that wants to fund you to do it. We can help on both parts, but all the people at Tor wear too many hats already, so the more self-starting you can be, the better.

Thumbs up!

I agree with the person who

I agree with the person who suggested forwarding to another web proxy.

I agree that many providers

I agree that many providers would choose to find ways to accommodate reputable anonymous users while blocking those who misuse their services if they knew the number of good accounts they lose. Part of the original post concerns the bottlenecks that interrupt the feedback loop by blocking or limiting access before traffic ever hits the site.

While voting with your feet works if the provider knows that and why traffic leaves, if they don't they may chalk it up to a Facebook campaign or sunspots or the Dow Jones: I am skeptical that Akamai sends out a report to their customers saying, "we started limiting Tor traffic on this date and return visits have dropped off x% since." This is, to paraphrase Donald Rumsfeld, something they won't know that they won't know.

As more users migrate to the cloud for services including hosting and commentary management, the tendency of providers to accept the loss of this information and control as standard operating procedure increases; once the standard shifts, the default changes from open to closed and that spreads from the hosted to the self-sufficient community.

I applaud the intention of this project to educate providers about the damage they do to themselves by blocking and allowing their vendors to do so on their sites.

"While voting with your feet

"While voting with your feet works if the provider knows that and why traffic leaves, if they don't they may chalk it up"

Actually they do not have to know. One day they wake up and realize that some service they have never paid attention to has surpassed them and they are on their descend into meaninglessness.

Look at Startpage.com which has surpassed a bunch of alternative search engines by focusing on the privacy theme.

As for blog spammers I think the basic solution are good content filters.

Looks like we're stuck in a

Looks like we're stuck in a chicken-egg problem: In order for sites to have a strong incentive to accommodate Tor users, many more people need to use Tor. But as long as a significant number of the most popular sites on the internet continue to block or restrict Tor users...

Well, I think part of it is

Well, I think part of it is a perception thing -- we have millions of daily users, so maybe we *do* have that momentum you speak of, but many of the service operators still assume Tor has six users, five of which are jerks.

One way forward would be to get actual concrete data from some of these services, about how much traffic they see from Tor and how much of it is jerks.

Article: Users Get Routed:

Article: Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries

ALL TOR USERS GET ROUTED AND THEY ROUTED ALL TO THE FBI AND CIA AND GOVERNMENT RELAYS FOR ANALYSIS AND ALSO FOR NSA ANALYSIS! YIKES!

Yikes indeed. Fortunately,

Yikes indeed. Fortunately, it sounds like you're misunderstanding the paper.

Check out
https://blog.torproject.org/blog/improving-tors-anonymity-changing-guar… for much more detail about three papers that touch on the same topic.

anyone else notice the DC

anyone else notice the DC relays 149.0.0.0, had exactly the same uptime as the ones doing the relay early attack? These appear to be run by an organization called TEAM CYMRU on cogent IP's

More details on the 'exactly

More details on the 'exactly the same uptime' part?

We know the Cymru folks and I don't currently think they're related to the cert attack.

I have suffered this problem

I have suffered this problem with pastebin. Up until very recently, several tor exit nodes were banned (picture of a cat above a monitor).
They seem to have switched to identify you with a captcha now.

Google is the worse you

Google is the worse you can't even post a comment on a blog as it vanishes into thin air.

I just noticed Mailinator is

I just noticed Mailinator is now killing Tor connections, maybe by slowing them down? I just tried to load that site like 12+ times, using New Identity each time (waiting a good 5+ minutes each time before testing again).

Give it a try, it's fun to sit there and watch teh page load for what seems like forever, and then just die

Did you know that on

Did you know that on trac.torproject.org is requires javascript and thinks everything from tor is spam? Someone should fix that.

There aren't enough

There aren't enough "someone"s in the world.

https://trac.torproject.org/projects/tor/ticket/12721
was the old state of things, which I think was worse.

linuxquestions.org and

linuxquestions.org and pastebin.com often block access to Tor users (even to the point where you can't read the answers/info, not just posting).

Also, trying to buy online services (e.g. a VPN, VPS, webhost, etc.) often decline payments to Tor users just for the fact that they're using Tor. Using all the same info and the same card will result in the transaction being accepted. This is due to the company which many of these sites use for fraud detection: Max Mind. They are trying to prevent people from using stolen credit cards, an admirable goal. Illustrating that it is only a small percentage of Tor users who are causing the problem, and suggesting on ways they could deal with this may get them to change their policy (especially if the suggestions are more effective at preventing fraud and allowing legitimate users than their current policy).

Got blocked from viewing (!)

Got blocked from viewing (!) a page where they aggregate and recycle science news:

"hello,
You are receiving this error message because your ip (w.x.y.z) is listed in the StopForumSpam.com database.
You can check the status of your IP and have it removed by visiting http://www.stopforumspam.com/removal. Thank you."

Finally got the page after changing the IP. Saw for the first time it was one of many sites by Bonnier Corporation. They have a bunch of speciality magazines and web sites. They block viewers with the same block list on their main corporate US web site.
They remind me a bit of Conde Nast without high profile sites like ArsTech/Wired/Reddit.

Realized from this there are a lot more sites that are surely closer to academia and more competent to report science topics.

Finally got the page after

Finally got the page after changing the IP.

There are exits which are used to distribute spam or which being abused different sort of malicious way.

arma does not want your

arma does not want your feedback. Read his lengthy post. He already has the solution. He simply wants to find some minion to do some work. He doesn't care what your idea is nor want to debate it. His path is the one true way.

Roger is the smartest person in the world that he knows of. When your ego is larger than David Chaum and Putin, you have a problem. Tor is run by an ego maniac.

- BlackSam

How is this a helpful post?

How is this a helpful post? I notice you have tried to start a tor-talk thread and make it into a flamewar too.

I recommend you actually figure out a way to usefully contribute to the privacy world, rather than just trying to tear things down.

My useful contribute is tor

My useful contribute is tor dead.

-BlackSam

YOU CANNOT FORCE THE

YOU CANNOT FORCE THE INTERNET TO ACCEPT ANONYMOUS USERS! ONLY WAY IS TO BUILD A TOR PROJECT THAT CAN CIRCUMVENT BLOCK WITH SUPER RANDOM SYSTEMS AND AT THE SAME TIME PROTECT YOUR PRIVACY! THERE IS NOT MUCH TIME LEFT BEFORE TOR PROJECT IS ONION PEELED BY THE VARIOUS GOVERNMENT AGENCIES AND OTHER ANTI-TOR CONTRACTORS!

And who this INTERNET entity

And who this INTERNET entity is...? Its just people and companies.
btw how you deal with traveling salesman in XX century? Would you leave your doors open after they knock ten times in a row?

sometimes I seriously

sometimes I seriously consider to file this petition to all keyboard manufacturers: stop building keyboards with that f*cking caps-lock key!! people just don't get it :-(

My impressions: using

My impressions:
using default mozillabrowsers,chrome etc., No Problem.

Using Torbrowser: Cloudflare&co -especially CloudFlare- gets very insane.
They hate anonym users.

I don't use TBB and I

I don't use TBB and I customize my user-agent to whatever is most common on the internet, not on tor. I disable javascript in the browser itself and via noscript. I use Linux, but would never use a distro targetted for paranoid people. I don't run Tor at home, never have. For years I have run Tor on virtual machines in a ram disk and I connect to it over an open source VPN, but ssh tunneling works too. I always use other anonymous methods to rent those virtual machines and sometimes I hop through a few of them to get to my Tor instance. Some VM's are like 3/month. The smallest VM can run Tor as a client. Being on a VM, I can leave it on 24/7 as suggested from day-1 of Tor's creation.

With exception to CloudFlare, I am rarely blocked from viewing sites. Most sites do block me from posting and I do not blame them. There are many sadist trolls that hide behind proxies, Tor, etc.

It's funny when you think about it... Most people forget CloudeFlare was not created to be a CDN. It became a CDN by mistake. It was a volunteer distributed security research project and people started using it as a CDN. I was one of the volunteers. It just so happened that it became a decent very low end CDN that was cheap and everyone started using it. The reason I mention this, is that CloudFlare was designed to detect and block malicious traffic. That was it's original number one goal. There are plenty of bots using Tor. I suppose you could get some engineers paired up with CF to find ways to block the bots and not the people.

I can confirm this. The

I can confirm this.
The problem lies within TBB not within Tor or the ExitNodes themselves. I still have TBB 3.6.4 and it works with CloudFlare most of the time. But TBB 3.6.5 and 4.0alpha are blocked close to 100%.

I normally don't require those sites using CloudFlare and if, I can switch to JonDoFox/JonDoBrowser which work well with Tor, but the general problem persists. Please find out what makes CloudFlare and other services block TBB and what can be done about it. It clearly has something to do with the version change from 3.6.4.

This may be a far more serious threat to anonymous surfing than blocks on ISP level. If more and more services start to block Tor, the future is going to look pretty grim.

tor bridges page does not

tor bridges page does not work.
tor bridges email service does not work.

Hay, YEAH word, this kind of

Hay, YEAH word, this kind of thing is making the internet unusable (not just for TOR users). I have been thinking about this problem for a long time. It sounds like your thinking is along my lines of thinking, that this is actually mostly a "cultural" problem that can be handled by presenting technological solutions. I would love to help out and do leg work, I have time on my hands. Could someone post a link to where the actual work is going to happen, or can a wiki or BBS be created somewhere? Bless and mo' powa!

I believe that some sort of

I believe that some sort of certificate of trust provider which specializes in anonymous users is the way to go.

Here are a few alternates to

Here are a few alternates to the tor browser...

Pay to use: Foxy Proxy

Free to use: Freenet and I2P

Alternatives in that they do

Alternatives in that they do different things, sure.

Chrome is also an alternative to Tor Browser, but it may not (probably won't) do what you want.

The United Nations are at

The United Nations are at work to dismantle the tor project. This is a warning!

Or, better yet, CloudFlare

Or, better yet, CloudFlare and the other websites can just stop worrying about what IP address X or Y is coming from and only filter when it matches a known attack!
I'm really getting tired of having to punch in CloudFlare captchas, only for my node to change 2 minutes later and I have to punch one in again!
If the captchas were made so that they were easy to input (i.e. no overlapping letters, evenly spaced, etc.) it would be different but sometimes I have to punch in 4 or 5 captchas before I finally get one right and the website in question lets me in!

This is why the list of IP

This is why the list of IP addresses of TOR exit nodes should not be published. Yes an attacker can still discover the exit nodes, but they change over time and most services are unlikely to make the effort on a continual basis...and with the TOR network as popular as it is now I really don't think the exit nodes need this list publicized to have plausible deniability (which was the original reason for publication, right?)

But perhaps this feature is already in TOR? Can BOTH the bridge and exit-node flags be honored on the same TOR node?

If they don't want TOR users

If they don't want TOR users then screw 'em...
all we need is a search engine for .onion addresses (like they have in i2p)

This is a wonderfully timely

This is a wonderfully timely project. I'm really glad.

On a related topic, web designers have a major role to play vis-a-vis privacy and the internet, not just the more tech-side people.

In the same way as accessibility issues became part of 'good web design', and security is (in theory!) part of 'good web design', so too does privacy need to become part and parcel of 'good web design'. It will then be taught on web design courses, and become expected of a professional designer.

The same goes for all the software engineering industry and other tech/IT professionals. Their roles need to feature the upholding of citizens' rights at every step of their design of solutions, and their proposals for projects.

It's a long way off, but we will get there.

Explain this to

Explain this to CloudFlare.
This site is definitely against Tor.
The NORMAL Google Captcha is working fine/normal with Torbrowser.
Cloudflare definitely NOT.

Cloudfare breaks all

Cloudfare breaks all websites that can usually be used with Tor, before they got cloudfare on their sites. :(

I have been getting

I have been getting Cloudflare re-captchas while browsing Shodan and whatismyip.com. I normally don't mind these but what is really annoying is that I get them every 1/2 hour, or after I change my search filter at Shodan. I don't see why Cloudflare has to do that, that often...

I do find it useful, however, that Cloudflare tells me when Shodan traffic is too high to browse, so I know which times of day are better. (.e.g. "you have been served a cached version of this page, retry for a live version?, or 502 bad gateway errors)

The CloudFlare Re-Captchas

The CloudFlare Re-Captchas work for me, its just that they happen too often (every 15 minutes to 1/2 hour). This is very disruptive.

most of us TOR users like

most of us TOR users like the fact that we are not tracked. we don't troll. we don't abuse. we just surf or do our business without malice...but we like our privacy and it would appear that the only way an INCIPIENT or DE-FACTO POLICE STATE can exist is by taking every last vestige of privacy away from the populace at-large, so that nobody has any privacy ever. You cannot be blackmailed or coerced for your internet activity if it is not actively tracked by some intelligence service of Israel or the U.S. or U.K.

sadly, the day is coming that TOR won't be able to go anywhere on the web without being denied, and all of the whining and hand wringing we do here won't prevent that. the jerks who want everything in the open don't like privacy except for THEM maybe, it's a very subjective thing. Do as we say, not as we do.

in time, TOR will be rendered moot. If you cannot use it to email or do banking or any of your other stuff like general web browsing or research, then why bother? as it is now there are times when the TOR network is so slow that you cannot connect, and the time windows for that occurring are getting longer and more prominent during the day. that and DDOS garbage on Skype and now we have a web that is all but useless.

coincidence? no. the web became too informational for the sheeple to be allowed to keep using, hence all this noise about killing TOR and online anonymity completely off.

a totalitarian nightmare regime has no use for privacy of it's citizenry. Ask Philip Zimmerman who developed PGP, he'll tell you what they did to him for ensuring we could 'whisper' if we wished, across the internet, and not compromise our communications.

the b.s. excuse is that 'terrorists' or 'criminals' are going to use TOR is absurd. Sure they will, but for that matter, anything good can be used by evil nefarious a$$holes anytime they so decide.

Privacy is a right. when we lose it, we lose almost all we have left in a dystopian nightmare being foisted on us by those who would render us all under serfdom. and we know who they are. the 'R' name which used to be 'B' comes instantly to most of our minds.

till we are totally declared chattel of the state, we should have the right to privacy online. Yes there are jerks who abuse this but that is no excuse to deny responsible people that privacy.

TOR will either sink or swim. Much propaganda has been floated by ZIO HEDGE about the hacking of TOR by the government of the U.S. You can see how they are threatened by people who wish not to have a camera installed in their colorectal orifice yet.

TOR is nearly dead. I don't know how we save it...or for that matter, keep our privacy. Oligarchy hates it when plebes have their privacy. Damn us all to hades for that need, eh? Damn us.

best to you all.

A TOR user who sees this is not going to go well too much longer.

You were able to so

You were able to so eloquently put into words using the correct wording that I've lost that's so essential to effective communication. I'm another example by now of the saying that if a person doesn't regularly use it they will most definitely lose it. Well said - right on what I was trying to say on the actual topic here.

":most of us TOR users like the fact that we are not tracked. we don't troll. we don't abuse. we just surf or do our business without malice...but we like our privacy and it would appear that the only way an INCIPIENT or DE-FACTO POLICE STATE can exist is by taking every last vestige of privacy away from the populace at-large, so that nobody has any privacy ever."

You said it perfectly. I felt my thoughts might be interpreted as paranoid and I might be viewed as a conspiracy theorist. Yet I used the words 'police state' but since I'm apathetic and lack sufficient interest in government anymore I would have had to research in order to find what term I needed - socialist, dictatorship, nazi or government as the true domestic terrorist regime. Not sure what it's starting to look like but all I could think of is what appears to be a police state forming which when I do watch the news these days after so long ago becoming so jaded or disallusioned with the sensationalism, lack of any positivity coupled with obvious bias by certain if not all news outlets... I just have too many problems in the microcosm of my own universe to find the capacity to watch what looks like propaganda and makes me sick and even more depressed to bear witness.

I know I don't have the right to comment on politics since I won't be a part of it. I've been told to STFU if i don't vote so I assume others who stay on top of current events would also not care to hear my ignorant observations. My grandfather told me back some 25 years ago when I announced that I'd washed my hands of the news since it was all so negative and hurt me - he said that not knowing what's going on makes me ignorant. He was angry and I took it as him calling me stupid when I knew I was quite intelligent. By now i realize what he was trying to say - ignorance, intelligence and education are not synonymous though it sure felt like he called me an idiot.

" the web became too informational for the sheeple to be allowed to keep using"

Did anyone else notice that certain instructions and information began to disappear quite a few years back? It was around 1997 when I went on a quest for previously available information I'd captured years before on floppies and 3.5" disks which I'd either lost or lacked the equipment to access the data I'd saved . I am not going to say which terms and instructions I was searching for but it was glaringly obvious that someone was censoring the net - maybe the FBI or CIA, much the same as when someone posts a threat to say the chief HNIC executive and I don't mean that in racist sense. It wasn't that I wanted to use the instructions, I just recalled how fascinating it was to find said detailed instructions previously and then find no remaining traces of that information.

I kind of reminisce about the days of no mice, using DOS and function and other key combinations to telnet or even dial up to BBSs and private sites. I cannot remember how I ever even found the sites I used Procomm or PCAnywhere to access but it was a different type of enjoyment with lack of any images much less pics to associate with the people with whom you spoke. Everything was left to prolific imagination due to staring at a simple monochrome monitor, a black screen and a prompt to deal with. I hated it as MS with each release dummied down to the point that using a mouse became unavoidable when I knew how to do everything so much more efficiently with commands. Those were different times.

When the Internet became readily available I remember well that I had far too much left to do offline so I put off getting it until someone paid for my service despite my claim that I didn't yet want it. I knew that it would be too much information and I'd be distracted from the things I enjoyed doing. Again, different times since by now I can't imagine what was on the list of things I wanted to complete without easily accessible Internet.

"TOR is nearly dead."

I'm not sure I can agree with that but then again, I've been in absentia since the fall of SR using mainstream means of accessing information never suspecting I was being monitored the whole time. I'd think that the end of SR was a huge hit to TOR since that's what surely brought it to a large group of people since TOR was required to watch the carnival sideshow. I had a strong feeling before SRs fall that the people were rising up and fighting back for their right to do as they chose even if that meant access to drugs or whatever. I felt it was a sign that the increasingly strict drug war measures were going to fail as people want and will get what they want at any cost if it's that important. When that empire fell, I was saddened much less to find out WHY it fell - and I guess it was no surprise in hindsight to know that basically there was an organized crime element. However, to have created such a place, a virtual black market that stayed under the radar for as long as it did was simply amazing. I just hate that the Pirate Dread Roberts had to brag and thus end his anonymity which was the whole point of such a thriving underground network that seemingly was invincible. Then again, I guess there's no way the powers that be weren't closing in from day 1 and as word spread something had to be done to show the public that no one is untouchable and can skirt the law for very long. Good run, though.

You also used one of my favorite terms since I was in 8th grade and used to sit in the reference section studying the huge volumes on the origin of words - their history, whether they changed meaning, became archaic and so on. When I found the word dystopia it's been my favorite word since though I was dismayed to find years later it had reentered modern language with a totally different meaning than the definition that so intrigued me. When I found the word it was no longer used - a word long lost. The description explained that it was NOT the antonym of utopia. If Utopia is paradise or heaven - dystopia was a place were everything wasn't right. It wasn't hell though it sounds much like it - just a place where all that could be wrong was just that akin maybe to Murphy's Law. The closest term I could ever find was like Seinfeld's bizarro world. Still that wasn't the same either so it was just a unique word. The last time I looked it up it was being used as a political term. You'll have to enlighten me on what it means to you the way you used it. =)

Excellent post.

Cloudflared: Chelsea

Cloudflared:

Chelsea Manning Support Network http://www.chelseamanning.org/ (please let them know! really wtf, is wikileaks cloudflared next?)
Cyanogen http://www.cyanogenmod.org/ (as linked by mikeperry at https://blog.torproject.org/blog/mission-impossible-hardening-android-s… )
Many more sites concerned with privacy, technology, computing freedom, and/or the national security state. Sites you would never expect to treat Tor users as untouchable-caste unworthies whose time can be frustrated by endless captcha loops. Unfortunately, it seems Cloudflare marketing is killer and admins don't actually know what they're being sold.

As discussed here and on tor-talk, Cloudflare in effect blocks tor users who disable javascript... and also helpfully embeds a google captcha (think about it). I have personally hit Cloudflare walls which only give Google's ip4.google.com rate-limit message in lieu of the captcha should be; which require javascript outright, instead of simply being difficult to use without it; which respond to a correctly-filled captcha by throwing another captcha; etc..... In practice, Cloudflare captcha is just a cheap and two-faced way to pretend not to block tor.

Captcha itself is evil. Really, think about it: What an insult, to be told to waste time squinting at deformed letters to "prove you're human". WTF? I have poor eyesight; and each time I squint through a captcha, it is one minute stolen out of my life. Captcha must be rejected in concept... and Cloudflare captchas are some of the worst. Cloudflare is one of the biggest and worst actors now segregating tor users into a "separate but (un)equal" internet where all the water fountains just happen to be broken, so to speak.

Okay, this irony is

Okay, this irony is delicious.

The very first link in arma's above post, https://www.opentechfund.org/labs/fellowships , is Cloudflared. I just clicked it, and received some squiggly letters plus the helpful advice that I should "run an anti-virus scan on your device to make sure it is not infected with malware". I doubt that will work on Tails, but anyway...

Think about it: How are we supposed to solve this problem, when the resources engaged by TPO leadership are treating Tor users as second-class netizens?

At this rate, I am afraid I will get the "Attention Required!" insult and broken captcha loop on Tor Blog itself. Or will I need to "prove I'm human" to download Tor through Tor?

(P.S., by the way, many papers in anonbib cannot be downloaded through Tor. Thanks for the Freehaven cache. I suggest that TPO leading lights should dogfood this when doing their scholarly research.)

Wikipedians say "we have to

Wikipedians say "we have to blacklist all these IP addresses because of trolls" and "Wikipedia is rotting because nobody wants to edit it anymore" in the same breath, and we believe these points are related

I'm sorry, but I think this gets the situation very much backwards. It is not "trolls"--it is massive, widescale, almost uncontrollable destruction of the resource.

What I find disturbing about this particular aspect of your discussion is that it appears not to reflect investigating the long history on Wikipedia of considering this question. It's not just about Tor. The question of anonymity has a long and extremely detailed history, and you are in no position to step in and convince them otherwise--they are right and you are wrong. Anonymous editing is intensely destructive to Wikipedia.

Further, many members of the community have written quite a bit about the fact that destructive editing of this sort, not the refusal to allow anonymous editing, is part of what keeps people away from Wikipedia.

The question of who edits Wikipedia, how and why has been one of the most sustained ones the community has dealt with, from the beginning. It is disturbing to me that you would simply say, offhandedly, that the solution developed by thousands of people over tends of thousands of encounters is wrong, because it happens not to fit with your own project.

The results for the first

The results for the first round of selection for the OTF fellowship came in !

I just tried to create a new

I just tried to create a new Twitter act using an openmailbox.org email address and for the first time I received a "Denied"signup page at Twitter. The message was "you cannot create an account from this computer. Download the Twitter app for iPhone or Android to create an account."

Twitter has shitloads of

Twitter has shitloads of arbitrary rules triggering automatic account locking. Apologetics say that these rules have to do with spammers' behavior, but apparantly no spam abuse report is required for them to kick in. The approximation is also very bad, and my Tor-spurning colleague has no problems with his accounts. So twitter should not be relied upon for anything. Better use GNU social.

But at least it's big enough not to be on cloudflare and you can still view public tweets without login.

CloudFare allows you to

CloudFare allows you to enter a message to website owner right after successful CAPTCHA verification. I always leave a message informing the owner that they should look for an alternative to CloudFare due to this issue. Not sure if they receive these messages or even care.

Here's an etherpad to make a

Here's an etherpad to make a list of cloudflared websites that harrass tor users with broken CAPTCHAs

https://pad.okfn.org/p/cloudflare-tor

Now that [at last] there's a

Now that [at last] there's a "brightnet" HiddenID-friendly blog, we find [facepalm] that this "psychosomatic" http warning is inevitable when trying to authenticate with an https site.

https://zzzen.com/hiddenid/#http-browser-warning

I hope that when you do this "tor secure service" fix, creating a "hidden service + SSL key + certificate" bundle would be easy via the python stem lib (e.g. easy to patch onionshare to be https).

If I'm not mistaken, HiddenID [not facebook] may be the only known application "in the wild" that inherently requires https, and even that is due to bureaucratic reasons ;)