Cloudflare requiring Javascript for Tor users (and others?)

[Lauda]

Bump, this issue occasionally causes problems for me as well. Sometimes I'm just stuck outside and hope CF eventually lets me in.

[Mitchell]

Sometimes I'm just stuck outside and hope CF eventually lets me in.

I couldn't help but imagine you like this:

[Chlotide]

Cloudflare has a JavaScript browser check when you do a server request from a "known bad" IP. It logs weird activity from that IP (like trying to access */admin.php or */wp-admin.php and can deny access to the page. I would assume this is mostly encountered while posting (add and get functions mostly). They call it Browser Integrity Check
https://support.cloudflare.com/hc/en-us/articles/200170086-Understanding-the-Cloudflare-Browser-Integrity-Check

Maybe it's worth a slight tweak, tho not sure if it would do more harm than good.

[nullius]

Bump.  I just had to try about a hundred Tor circuits to get in without JS.  Usually, when I hit the bot-check page, I only need to try one or two new circuits.

I’m not so much complaining.  I know it’s gotten really bad out there...

In other thread:

I add a fifth hypothesis:  A sudden, massive increase in DDoS attacks against many sites.

The periodic slowness was coming from a few smallish DDoS attacks. Often what happens is that the site will become slow for 10-60 minutes before automated systems are able to identify and block the attack.

...but I think I should document this somewhere, (a) for the benefit of other NoJS Tor users, and (b) to advise others why, if I fall even further behind on threads as I’m trying to catch up.

I know that Cloudflare is adaptive, and this kind of problem will probably subside after awhile—until next time DDoSers launch a big one through Tor.

Edit to add quick note to theymos:  Site seems faster (100% subjective perception).  Maybe the system is stricter now, with higher false-positives?  Wild guess; trying to write quickly, and not say anything that could be misinterpreted as criticism.  Just trying to diagnose.

Sometimes I'm just stuck outside and hope CF eventually lets me in.

I couldn't help but imagine you like this:

That was a funny picture in the context.  I remember it.  (Edit:  Woah, it’s suddenly back!  Image proxy has trouble with IBB sometimes?)  Too bad the earliest archive I can quickly find (only three months later) doesn’t have it.

Trying to bat this post out ASAP, before my current Tor circuit times out.

[Catenaccio]

Image proxy has trouble with IBB sometimes?)  Too bad the earliest archive I can quickly find (only three months later) doesn’t have it.

You can try with https://www.talkimg.com/
TalkImg.com - Image hosting for BitcoinTalk.

It's not an official image uploading of this forum but theymos recommends it in Forum SMF Bulletin board code.

TalkImg.com is unaffiliated with bitcointalk.org, but was created by joker_josue to work especially well here.

Another choice is this https://bitlist.co/upload from TryNinja, another forum member.

[snipie]

Someone will necro all his topics and mourns all known figures from years ago.
@ respectable mods, no double standards. Thanks.

[nullius]

The following applies to all forum members who use Tor Browser in “Safest” mode—and potentially to all forum members who use Tor.  It is not only about me.

* nullius recommends that everyone should use Tor Browser at its “Safest” security level.

@theymos, I respectfully suggest that the ccode login pages should bypass the failed-login IP ban.  Also, heads-up:  It seems that someone is currently abusing Tor to attempt breaking into accounts (perhaps with a captcha solver?).  I’m trying to guess if this may be somehow related to the DDoS or not—and/or if there’s some way an attacker may believe that they have a list of Bitcoin Forum credentials, but they somehow get many wrong.

Response to submission of the form from many Tor exits (see below):

An Error Has Occurred!

Your IP has had too many failed login requests recently. Your IP is banned from logging in for a few days. If you are using Tor, request a new Tor identity or use a different proxy just to login.

Note:  “Use a different proxy” is bad advice for Tor users.  Tor and non-Tor usage should never be mixed with the same long-term identity.  This is standard Tor advice, not my own idea—and anyone advanced enough to violate it safely doesn’t need any suggestions at all.  For their own safety, newbies need to be warned strictly never to mix Tor with proxy or other non-Tor; this is a common footgun for newbies!

I think the only security risk is if an account’s ccode has been stolen; then, of course, bypassing the IP ban would let an attacker attempt bruteforcing that account’s password.  I regenerated my nullius account’s ccode last week, just in case of php2shell compromise.  I didn’t yet for others—and I guess most forum members probably haven’t regenerated their ccodes.  (I guess most don’t even know their own ccodes.)


The problem I posted about earlier has partly subsided.  Now, however, it seems that most of the Tor exits with no Cloudflare JS check are banned for days from logging in, even with ccode.

Right now, it is difficult to find a Tor exit from which to log in with no JavaScript.  If it gets any worse, I’ll be unable to log in.  If the ban of an IP persists for days, then an attacker could DOS all Tor users:  Prohibit Tor users from logging into the forum by getting all Tor exits banned.  Tor exit IPs number only in the thousands.  This could even apply to exits that are getting the Cloudflare bot check, if the attacker has a way to pass Cloudflare Turnstile with browser automation; I wouldn’t know it, because I have JS disabled.

Cycling through Tor exits is a problem for 2FA users, because the TOTP code always has a short expiration.  This may deter NoJS Tor users (or all Tor users?) from using 2FA, which would reduce security.  I am currently considering that I may disable 2FA.

If you want any private feedback or discussion of this, please feel free to PM me.  I’d be happy to help tweak the login system’s design just a little bit so it remains secure against bruteforce, and it is secured against an attacker potentially mass-banning/DOSing Tor users from login.  I limit public remarks about my thinking on this.

[PrivacyG]

I was able to easily log in to my account today, but 2026 was the worst year of this Cloudflare no Java Script problem.  There were days I even gave up logging in because there was absolutely no way I could get past that Java Script requirement message.  It has been happening about every other day now for a long time, but all I can do is hope things will get better.

I never really mention these problems because I know I am one of the probably very few who do not use Java Script while browsing the Forum, but I would be grateful if a working solution can be found.

[theymos]

@theymos, I respectfully suggest that the ccode login pages should bypass the failed-login IP ban.

Done. This should be very-low-risk, since a ccode will be removed from an account if too many bad attempts are made with a valid ccode.

On the problem generally, I don't see a great solution. There's always a constant flood of abusive traffic, and controlling it based on IP is the only reasonably-effective way of keeping it in check.

Now that Tor supports PoW for hidden services, I'm hopeful that Cloudflare will eventually integrate that into its transparent onion routing (which bitcointalk.org uses), which would allow Tor users to bypass the Cloudflare challenge without JavaScript.

[nullius]

Done.

theymos, thank you for your principles.  Nowadays, strong support for Tor+NoJS is so rare outside of communities where Tor+NoJS is the norm.

I never really mention these problems because I know I am one of the probably very few who do not use Java Script while browsing the Forum, but I would be grateful if a working solution can be found.

I mention these problems, because I know we have an administrator who cares!

On the problem generally, I don't see a great solution. There's always a constant flood of abusive traffic, and controlling it based on IP is the only reasonably-effective way of keeping it in check.

I understand this.  It’s why I am cautious about making statements that could be misinterpreted as harsh criticism.  I know that some vocal “anon” types see only their own needs—not the practical necessities involved in running the site.

Constructive suggestions are better.  Here is one, which I very loosely base on this discussion way back when you first announced moving to Cloudflare:

Is there an official .onion proxy of BitcoinTalk that bypass Cloudflare?

THIS.  Thank you.  A Bitcointalk .onion was on my mind all week, [...]

Perhaps we could even get a Bitcoin Forum Onion onto RFC 7686 co-author Alec Muffett’s list of Real-World Onion Sites.  I don’t know if it would be accepted, but that list carries a diverse range of sites—from Riseup to Cloudflare Public DNS 1.1.1.1 to (LOL) the the U.S. Central Intelligence Agency.  Some of the sites on this list primarily run an onion to help evade censorship by repressive regimes; IIUC, it is for this reason that Voice of America and Radio Free Europe have run onions (but they’re now down?).  It would be another good motive for a Bitcoin Forum Onion.

In the context of this thread, I see a twofold potential advantage:

• The onion can use Tor’s built-in DDoS protection, as you note (see below).  It is not only the POW; Tor has a bunch of relevant tunable knobs for onion administrators, which I don’t know off the top of my head.
• Perhaps you could let advanced users authenticate with public keys at the onion level, at a separate onion address.  It’s been a few years since I read the v3 onion spec; I need to look back at this, and see if it would be feasible for the likely number of users.  Doubtful?  But if so, I do know off the top of my head that by v3 onion’s design, no one can even contact the authenticated onion site to DOS it without an authentication key.

In the community spirit, I’d be happy to contribute effort to making this happen.  I’m not an experienced onion administrator—but I know the protocols, and I learn fast.  If you’re interested in an exploratory investigation of this idea, please let me know whether I should start a new Meta thread to solicit discussion from other experts in the community, or discuss it privately to avoid getting people’s hopes up for a feature that may not happen.  (A new thread would not be immediate, but maybe within the next week or two; I’d need first to catch up on other threads, and do some research.)

Now that Tor supports PoW for hidden services, I'm hopeful that Cloudflare will eventually integrate that into its transparent onion routing (which bitcointalk.org uses), which would allow Tor users to bypass the Cloudflare challenge without JavaScript.

Did I miss a wider deployment of this?  I’m behind on the latest Tor development, but I’ve been compiling the GPL POW code into my own Tor daemon for years.  I need to check if this is in the binary distribution packaged with Tor Browser, and also what the status is for Arti.

Aside, not to complain to you but to help others if they have this problem:  Cloudflare’s onions are sometimes problematic.  I used to run a special browser instance for the Bitcoin Forum with AltSvc disabled, to avoid the Cloudflare onions; this made me fingerprintable, of course, but so did my login cookie!  It’s gotten better, but their onions are sometimes still flakey.  As a workaround when a Cloudflare onion in the AltSvc cache becomes unreachable (= connection timeouts), Ctrl-Shift-L for Tor Browser to change to a new circuit contacts the clearnet site via an exit node, and thus gets a fresh AltSvc onion from Cloudflare.

(I have private patches in my Tor daemon to help me diagnose what’s going on.  I always build my Tor daemon from source—and I clone/pull it from the official onion git repo for the C tor daemon.)