Bitcoin Forum

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.

Privacy is number one priority and if we can not use TOR then we are compromising it. I think Cloudflare is not a solution anymore. The forum has enough money to invest in forum related issues and this is a major issue. How long we will need to wait for some technology that can replace the annoying experience with Cloudflare?

I'm also a Tor user for mobile; I just tried accessing the forum through it right now, and everything works perfectly. The cloudflare verification went smoothly the moment I clicked on prove I'm human; there was no more delay.

Although I couldn't access the forum yesterday without vpn and tor browser, without them it just showed loading page of Cloudflare and error.

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.

I guess I am not the only one or am I?

Privacy is number one priority and if we can not use TOR then we are compromising it. I think Cloudflare is not a solution anymore. The forum has enough money to invest in forum related issues and this is a major issue. How long we will need to wait for some technology that can replace the annoying experience with Cloudflare?

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.

Privacy is number one priority and if we can not use TOR then we are compromising it. I think Cloudflare is not a solution anymore. The forum has enough money to invest in forum related issues and this is a major issue. How long we will need to wait for some technology that can replace the annoying experience with Cloudflare?

It was impossible to access the forum with Tor for about 48 hours, I tried with various connection settings in Tor, but CF simply did not allow the captcha challenge to pass. Apparently the attack lasted a little longer than usual, but now everything is back to normal.

As reminder, using CloudFlare already reduce our privacy. I also recall theymos would change if there's other technology or service which isn't far more expensive than CloudFlare.

As reminder, using CloudFlare already reduce our privacy. I also recall theymos would change if there's other technology or service which isn't far more expensive than CloudFlare.

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.

Privacy is number one priority and if we can not use TOR then we are compromising it. I think Cloudflare is not a solution anymore. The forum has enough money to invest in forum related issues and this is a major issue. How long we will need to wait for some technology that can replace the annoying experience with Cloudflare?

I guess I am not the only one or am I?

I think Cloudflare is not a solution anymore.

This topic is inactive for almost a year now, sorry to necrobump it  ::)

Just in case theymos missed the following message:

I don't know if it will have any effect, but if you haven't tried bridges, you can try under Settings -> Connection -> Use bridges ON -> Select a bulit-in bridge

Well, there are other solutions. But I wonder, if there will be enough users, willing to switch to P2P-based forum. Because then, DDoS-protection would work as in Bitcoin: if you have many nodes, with proper setup, then you cannot DDoS some P2P network that easily. However, will people agree to run their own full nodes, and download all posts, no matter if they are going to read them or not? I don't think so, and that's one of the reasons, why we have so many centralized points on the Internet: not every user will agree to share its own resources, and set up a full node.

By the way: I posted this message from Tor, so it works for me. However, I encountered similar problems in the past.

This challenge only comes up when you're using known Tor/Proxy IPs which is usually where DDOS attacks originate from. In terms of L7 attacks, the challenge is what limits its effectiveness before it hits your site. When facing large DDOS attacks or sophisticated ones, you don't have many good options beyond CloudFlare. Privacy is compromised eitherways when traffic has to go through someone else before you.

If you're facing extremely long load times for captchas, it is often better to actually just change the routing circuit.

I don't know if a very small number of people use Tor on this forum (it seems so to me), because for two days the forum was inaccessible to me through the same thing, and you are the first to complain about it. It is possible that for some reason you still have problems, I don't have them at all anymore, and someone didn't even have them yesterday.

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.
-snip-

Privacy of the forum users comes first or the expense? If we did not have enough money than it was something else.

Not really. I don't know of any better solution which wouldn't require a lot of manual work to keep it working.

Cloudflare actually isn't even very good at identifying bad traffic or delivering on several of its claimed features, but it offers two extremely valuable tools:
 1. It completely blocks even massive IP/UDP/TCP flooding without any thought on the end-user's part. My custom DDoS protection was also able to block these attacks, but it required a significant amount of sysadmin work.
 2. My custom protection failed against layer-7 attacks from 100k+ IPs. To handle these attacks, there needs to be some sort of proof-of-work/CAPTCHA challenge before the application starts making database queries and such. These challenges must exist on servers which will automatically scale to handle any number of requests, as needed. The challenge servers must have the HTTPS key in order to function. It would definitely be possible to do this without something like Cloudflare, and I've posted a general description of how it could be done, but both the coding and sysadmin work are more than I want to deal with.

Cost is a consideration, but not the primary one: I'd consider paying 10-30x more than Cloudflare's $250/mo, if this came with significant improvements. But as far as I know, you don't actually get much more by paying an "enterprise" DDoS protection company $5000/mo than you do by paying Cloudflare $250/mo, and in fact you often seem to get less.

This challenge only comes up when you're using known Tor/Proxy IPs which is usually where DDOS attacks originate from. In terms of L7 attacks, the challenge is what limits its effectiveness before it hits your site. When facing large DDOS attacks or sophisticated ones, you don't have many good options beyond CloudFlare. Privacy is compromised eitherways when traffic has to go through someone else before you.

At least for DDoS by attacker who use Tor network, it can be mitigated by enabling PoW feature.

Only for onion service though. Forum would have to have a onion version and Tor users have to surf using that only.

How demanding is it to make an onion version of the forum? Considering that these attacks last longer and longer, it would be really good to have an onion version that, if I understood correctly, would be resistant to such attacks.

How demanding is it to make an onion version of the forum? Considering that these attacks last longer and longer, it would be really good to have an onion version that, if I understood correctly, would be resistant to such attacks.

Again, I don't think that theymos will buy the idea because of the reputation of the forum. Having an onion version might take the government's eyes to the forum and some kind of legal compliances would be required.

Besides, running an onion version of the forum will require some more resources to reconfigure the server and secure same against attacks. I don't think we are committed to all these now.

Maybe you can use the 'Captcha bypass code' feature (https://bitcointalk.org/captcha_code.php (https://bitcointalk.org/captcha_code.php)) when logging in to Bitcointalk again.

I also tried using the Tor Browser to post on Bitcointalk, which is relatively smooth.

Logging in is not the issue that Royse777 is talking about. That is using reCaptcha, for which there is already a workaround but this one that OP is referring to specifically is when you try to open any page on the forum, but you can't because you see a Cloudflare screen that never goes away, even if you complete the captcha 10 different times.

The Cloudflare blocks are IP-based. Doesn't stop them from banning all tor exit nodes though.

Logging in is not the issue that Royse777 is talking about. That is using reCaptcha, for which there is already a workaround but this one that OP is referring to specifically is when you try to open any page on the forum, but you can't because you see a Cloudflare screen that never goes away, even if you complete the captcha 10 different times.

The Cloudflare blocks are IP-based. Doesn't stop them from banning all tor exit nodes though.

Due to the behavior of some individuals using the Tor network (spammers, distributors of malware, attackers), the IP addresses of Tor exit nodes may earn a bad reputation, elevating their Cloudflare threat score.

Our basic protection level issues challenges to visitors whose IP address has a high threat score, depending on the level chosen by the Cloudflare customer.

Yes you are correct. This is the only reason for me from last a few days I am not regularly online after coming back from hospital. I really don't feel comfortable to use a VPN which I am using now :-(

Thanks for the correction. It seems that is the problem that Royse experienced some time ago.

Is IP blocking by Cloudflare related to the following?

Do you still have the same issue?

Not for bitcointalk I believe. We already use Tor routing which means for the basic protection level on CloudFlare, we doesn't require a CAPTCHA challenge. The traffic goes straight to the CloudFlare Onion address. The CAPTCHA re-appears when you have an elevated protection level.

If your site doesn't have the CF onion routing function enabled, then it would go through the exit node and this behavior would be normal.

I do not understand technology that much, Most of the time it brings the page without the hummin verification section of the page, like you can see in the below image.

What version or variant of Tor browser are you using? In my experience using Tor browser, I haven't encountered the CF verification unless the website is experiencing significant load.

Version 13.5.1 (64-bit)
According to the version information, this is the latest version.

I understand your concern, but when you're already using a VPN, you have to accept that this is the highest level of privacy you can currently achieve. If you're worried that "someone" could get your real IP address that way (which is quite possible), you should know that even Tor won't protect you if powerful enough three-letter agencies target you.

Can you explain in a little more detail how to see through which CF servers the traffic goes - and are there any settings that @AB de Royse777 can try to overcome the problem?

Version 13.5.1 (64-bit)
According to the version information, this is the latest version.

Can you explain in a little more detail how to see through which CF servers the traffic goes - and are there any settings that @AB de Royse777 can try to overcome the problem?

That's really strange, because apparently I and everyone else have had no problems accessing the forum via Tor since the attack stopped.

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.

The forum has enough money to invest in forum related issues and this is a major issue.

With regret, I am (for now) admitting defeat on the DDoS front, and we will soon be using using Cloudflare to protect against DDoS attacks. ~

I really don't believe in willingly putting a man-in-the-middle in your HTTPS like this, but my homebrew DDoS mitigation has been one of my biggest time sinks for the last 6 months or so, and the necessary servers are still pretty expensive. If I had more manpower, then I would prioritize maintaining our own DDoS protection, but with me as the only sysadmin and current-software developer, it's become unsustainable.

I especially dislike Cloudflare, which I'm almost certain is basically owned by US intelligence agencies. I considered several alternatives to Cloudflare, but the smaller ones (eg. Stackpath and OVH) didn't strike me as reputable/competent enough, and the enterprise-targeted ones like Incapsula and Akamai are around $3500/month. Even though $3500/month seems absolutely ridiculous to me, I was seriously considering Incapsula due to its pretty good reputation, but then they were having all sorts of technical issues while I was trying to set it up. So I gave up for now and went with Cloudflare.

The Internet is seriously flawed if everyone needs to huddle behind these huge centralized anti-DDoS companies in order to survive...

Privacy of the forum users comes first or the expense?

Quoting a previous message, hope that theymos will see it:

Maybe you can use the 'Captcha bypass code' feature (https://bitcointalk.org/captcha_code.php (https://bitcointalk.org/captcha_code.php)) when logging in to Bitcointalk again.

I don't think that theymos will buy the idea because of the reputation of the forum. Having an onion version might take the government's eyes to the forum and some kind of legal compliances would be required.

I guess now I need to get used to with VPN. It's the last thing I wanted but to maintain the business, from the responsibility I am taking the risk otherwise I would take a break from Bitcointalk until the DF thing was settled.

The error meessage that you shown, can sometimes come when you internet is not working well or is slow.

Once you've compromised your privacy, it's lost forever. If your VPN can't be trusted, it's too late after using it only once.
You could use a virtual desktop on a VPS, and access that through Tor. But that's slow and annoying to work with.

@AB de Royse777, do you have any new details regarding your problem? You should always take into account that something else can have an impact on Tor, but the only thing that comes to mind is to look in the settings of your antivirus/firewall and maybe restart your modem.

Instead of resetting everything, I would still (given that you don't have too much time) go in the direction of trying to eliminate the problem step by step - for a start (if you haven't already) try to reinstall Tor, because as far as I can see the new version is available for download.

Also check if your AV/firewall might be blocking some of these things -> https://support.torproject.org/tbb/tbb-10/

a general tech discussion board
~
I’ve got countless tech questions that do relate to bitcoin

-snip-
Therefore my best advice is to login with tor and tick on always logged in this will keep you logged in and prevent you facing future captcha issues. On the other hand while surfing the forum make sure you have strong internet and avoid hitting the button to view all the replies on a thread as that will cause a whole lot of cloudfare issues.

For some reasons BTT and TOR doesn't go that well for me. The last time I tried using TOR, I couldn't even connect to the internet! It just keeps saying establishing a connection or something, but never connects. The first few weeks it works properly but after some times this annoying bug occurs, which I have no idea why! Also tried the resetting reinstalling TOR or changing country or bridge firewall whatever it is. Nothing fixes. I guess something was blocking TOR from connecting.