It is impossible now to access Bitcointalk with TOR

[AB de Royse777]

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.

Privacy is number one priority and if we can not use TOR then we are compromising it. I think Cloudflare is not a solution anymore. The forum has enough money to invest in forum related issues and this is a major issue. How long we will need to wait for some technology that can replace the annoying experience with Cloudflare?





Theymos?

Cheers,

[Hazink]

I'm also a Tor user for mobile; I just tried accessing the forum through it right now, and everything works perfectly. The cloudflare verification went smoothly the moment I clicked on prove I'm human; there was no more delay.
 
But the only problem there is that you have to keep on verifying in each of the actions you want to take on the forum, like now trying to post this comment, I'm required to pass the verification process again.

[Crypto Library]

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.

Privacy is number one priority and if we can not use TOR then we are compromising it. I think Cloudflare is not a solution anymore. The forum has enough money to invest in forum related issues and this is a major issue. How long we will need to wait for some technology that can replace the annoying experience with Cloudflare?

It's working. I have only faced the general slowness that has to be faced while running the Tor browser.

Although I couldn't access the forum yesterday without vpn and tor browser, without them it just showed loading page of Cloudflare and error. Although I think it is may for the current condition of my region.  .
But in your case may it can be an issue of your ISP ?

[BlackBoss_]

I'm also a Tor user for mobile; I just tried accessing the forum through it right now, and everything works perfectly. The cloudflare verification went smoothly the moment I clicked on prove I'm human; there was no more delay.

Connection to the forum via Tor can work smoothly like at the time you did it but it can not work at different times, like recent days. It's harder to connect to the forum with Tor, and when you try to log in your account with Tor, you will have more problems.

Things are better now, today, I can confirm it because I log in easily than yesterday and by that, I can make this post.

Although I couldn't access the forum yesterday without vpn and tor browser, without them it just showed loading page of Cloudflare and error.

I believe the opposite is true, more access problems when you use Tor or VPN. I don't use VPN so I only can guess but if you access forum without Tor, it would be easier, not harder.

[Charles-Tim]

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.

If you want easy access, Tor is very annoying. Although, I tried Tor on my browser and it is working. But as I access this forum frequently, I have stopped using Tor. Some VPN are also frustrating but which I will not mention. I have used a VPN in the past that connects just like I connect with IP address.

[ABCbits]

I guess I am not the only one or am I?

I only saw the verification page few times in last few days. But on my device (with Tor browser), the verification only happened less than 15 seconds and then CloudFlare stop annoy me for few hours.

Privacy is number one priority and if we can not use TOR then we are compromising it. I think Cloudflare is not a solution anymore. The forum has enough money to invest in forum related issues and this is a major issue. How long we will need to wait for some technology that can replace the annoying experience with Cloudflare?

As reminder, using CloudFlare already reduce our privacy. I also recall theymos would change if there's other technology or service which isn't far more expensive than CloudFlare.

[EarnOnVictor]

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.

Privacy is number one priority and if we can not use TOR then we are compromising it. I think Cloudflare is not a solution anymore. The forum has enough money to invest in forum related issues and this is a major issue. How long we will need to wait for some technology that can replace the annoying experience with Cloudflare?

You might want to hear the side of the forum administration as well, a thing like this can't happen without a reason whether you like it or not. Tor has an issue of its own to the point that verification is often difficult which is certainly not the fault of the forum in my understanding, it's a middle connectivity bridge for security reasons. Also, I know that many things could be happening which makes the forum decide on the verification which was not there before. This may not be limited to DoS attacks, but they can't be telling us all these all the time.

Have you tried this on other websites? Because many serious and reputable sites are now using this verification as a procedure, it's not peculiar to Bitcointalk, anything security shouldn't be taken for granted. If you try it on Tor with other websites, I can assure you that you will experience similar unending verification issues. Besides, there are good VPNs out there, if they can solve this issue for you, then it's not a big deal anymore, they are equally safe. Bitcointalk is not where we keep our money to have warrant such a huge fear you portrayed.

[Lucius]

It was impossible to access the forum with Tor for about 48 hours, I tried with various connection settings in Tor, but CF simply did not allow the captcha challenge to pass. Apparently the attack lasted a little longer than usual, but now everything is back to normal.

I'm also a Tor user for mobile; I just tried accessing the forum through it right now, and everything works perfectly.
~snip~

Otherwise, I have no problems accessing the forum when it comes to desktop computers and Tor, but for some reason the mobile version of Tor always has problems accessing this forum. It's like there's some extra level of security that the forum or CF has implemented towards mobile users.

[AB de Royse777]

It was impossible to access the forum with Tor for about 48 hours, I tried with various connection settings in Tor, but CF simply did not allow the captcha challenge to pass. Apparently the attack lasted a little longer than usual, but now everything is back to normal.

It's still not normal in my side. I am still using the VPN connection as I had no success from the TOR yet.

As reminder, using CloudFlare already reduce our privacy. I also recall theymos would change if there's other technology or service which isn't far more expensive than CloudFlare.

Privacy of the forum users comes first or the expense? If we did not have enough money than it was something else.

[promise444c5]

Mostly use tor with PC, on mobile it spins over and over again, not to mention having to do an extra captcha ver. which looks almost endless , it just keep bring up next over and over most times somehow frustratingactually.
I was like

Still works though  I was still able to access the forum just the increase in verification level which is not too new.

[ranochigo]

As reminder, using CloudFlare already reduce our privacy. I also recall theymos would change if there's other technology or service which isn't far more expensive than CloudFlare.

I definitely don't think the cost would be a huge factor, when comparing cost and benefits. There are solutions that are far more expensive than CloudFlare but doesn't perform much better. Generally, if you compare enterprise solutions and CloudFlare's $250/month, you're probably going to face similar problems.

This challenge only comes up when you're using known Tor/Proxy IPs which is usually where DDOS attacks originate from. In terms of L7 attacks, the challenge is what limits its effectiveness before it hits your site. When facing large DDOS attacks or sophisticated ones, you don't have many good options beyond CloudFlare. Privacy is compromised eitherways when traffic has to go through someone else before you.

If you're facing extremely long load times for captchas, it is often better to actually just change the routing circuit.

[Mia Chloe]

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.

Privacy is number one priority and if we can not use TOR then we are compromising it. I think Cloudflare is not a solution anymore. The forum has enough money to invest in forum related issues and this is a major issue. How long we will need to wait for some technology that can replace the annoying experience with Cloudflare?

I stopped making use of tor and onion browser for a quite a while now. The captcha is just something that you can't almost crack easily with secure browsers. The only way from my experience that the captcha issue is not faced is when you turn of security on your tor. Of what use is it if one does that.

I did an experiment sometime ago where I tried using tor for a week then chrome for another. As expected, I faced multiple captcha issues with tor however I never faced one with chrome in fact a majority of times hitting I'm not a robot on chrome doesn't even require further verification before you are granted access.

The cloudfare issue is something numerous users here on the forum have Complained about multiple times saying secure browsers are difficult to use in surfing the forum which is totally true. The fact is I don't see it getting fixed anytime soon.

Therefore my best advice is to login with tor and tick on always logged in this will keep you logged in and prevent you facing future captcha issues. On the other hand while surfing the forum make sure you have strong internet and avoid hitting the button to view all the replies on a thread as that will cause a whole lot of cloudfare issues.

[Lucius]

It was impossible to access the forum with Tor for about 48 hours, I tried with various connection settings in Tor, but CF simply did not allow the captcha challenge to pass. Apparently the attack lasted a little longer than usual, but now everything is back to normal.

It's still not normal in my side. I am still using the VPN connection as I had no success from the TOR yet.
~snip~

I don't know if a very small number of people use Tor on this forum (it seems so to me), because for two days the forum was inaccessible to me through the same thing, and you are the first to complain about it. It is possible that for some reason you still have problems, I don't have them at all anymore, and someone didn't even have them yesterday.

I don't know if it will have any effect, but if you haven't tried bridges, you can try under Settings -> Connection -> Use bridges ON -> Select a bulit-in bridge

[vjudeu]

I guess I am not the only one or am I?

You are not the only one. In general, if someone abused some IP, before you got it, then you can see the consequences. It is a sad thing, that many Tor nodes are misused, and they are then blacklisted, or temporarily-banned. In general, there is only one working solution, if you are in a hurry: try a different IP. But obviously, it only delays the problem, without solving it. And I don't know the solution.

However, if the abuser will switch to a different IP, and the lock from Cloudflare has a timeout, then it should be possible to use the same IP again. I guess many locks are temporary, because in other case, it would be impossible to access clearnet from Tor.

I think Cloudflare is not a solution anymore.

Well, there are other solutions. But I wonder, if there will be enough users, willing to switch to P2P-based forum. Because then, DDoS-protection would work as in Bitcoin: if you have many nodes, with proper setup, then you cannot DDoS some P2P network that easily. However, will people agree to run their own full nodes, and download all posts, no matter if they are going to read them or not? I don't think so, and that's one of the reasons, why we have so many centralized points on the Internet: not every user will agree to share its own resources, and set up a full node.

By the way: I posted this message from Tor, so it works for me. However, I encountered similar problems in the past.

[paid2]

Quoting a previous message, hope that theymos will see it:

This topic is inactive for almost a year now, sorry to necrobump it 

Just in case theymos missed the following message:

--snip--
I have however decided to use a residential proxy on top of my setup to access this forum from now. Hopefully theymos will consider some better alternative to Cloudflare within next years or at least could re-configure the current Cloudflare settings to facilitate access to users with complex Tor setups. We are also ready to provide technical assistance in Cloudflare-less DDoS protection setup if it's the case.

[dkbit98]

Forum is working fine for me with Tor browser, maybe you should try switching new identities and see if that helps.
This could also be related with recent attack that happened few days ago, I couldn't use forum in a normal way.
I would prefer if theymos created separate onion address for bitcointalk, but I know this could be complicated. 

[ranochigo]

I don't know if it will have any effect, but if you haven't tried bridges, you can try under Settings -> Connection -> Use bridges ON -> Select a bulit-in bridge

CloudFlare only sees your exit node and thus the bridge shouldn’t have any effects. In fact, bridges should be used exclusively for circumventing censorship.

Well, there are other solutions. But I wonder, if there will be enough users, willing to switch to P2P-based forum. Because then, DDoS-protection would work as in Bitcoin: if you have many nodes, with proper setup, then you cannot DDoS some P2P network that easily. However, will people agree to run their own full nodes, and download all posts, no matter if they are going to read them or not? I don't think so, and that's one of the reasons, why we have so many centralized points on the Internet: not every user will agree to share its own resources, and set up a full node.

By the way: I posted this message from Tor, so it works for me. However, I encountered similar problems in the past.

It would probably be better to just pay more rather than to develop it again from the ground up. Hosting the forum on onion can potentially be a good idea as well. CloudFlare provides their services on onion sites as well and being able to segment Tor and normal users would be better.

[AB de Royse777]

This challenge only comes up when you're using known Tor/Proxy IPs which is usually where DDOS attacks originate from. In terms of L7 attacks, the challenge is what limits its effectiveness before it hits your site. When facing large DDOS attacks or sophisticated ones, you don't have many good options beyond CloudFlare. Privacy is compromised eitherways when traffic has to go through someone else before you.

If you're facing extremely long load times for captchas, it is often better to actually just change the routing circuit.

I don't understand the technical things. But changing the circuit was done all the time, nothing changed when it was not working.

I don't know if a very small number of people use Tor on this forum (it seems so to me), because for two days the forum was inaccessible to me through the same thing, and you are the first to complain about it. It is possible that for some reason you still have problems, I don't have them at all anymore, and someone didn't even have them yesterday.

After many hours of trying, I am posting this using TOR connection.

I don't know if the issue has resolved, let's hope after closing the browser I do not start facing the issue again.

[Husna QA]

I guess I am not the only one or am I? For last a few days when I try to access Bitcointalk with TOR I continue to redirected to Cloudflare human checking window. I was in the same loop for the last a few hours today too and now I had no way but to buy a VPN and posting this topic using the VPN. I am not a VPN friendly person. TOR is my trust.
-snip-

Maybe you can use the 'Captcha bypass code' feature (https://bitcointalk.org/captcha_code.php) when logging in to Bitcointalk again.

I also tried using the Tor Browser to post on Bitcointalk, which is relatively smooth.

[ABCbits]

As reminder, using CloudFlare already reduce our privacy. I also recall theymos would change if there's other technology or service which isn't far more expensive than CloudFlare.

Privacy of the forum users comes first or the expense? If we did not have enough money than it was something else.

I'll just quote this post.

Has anything changed on the topic of DDoS protection? Maybe new, better options? Cheaper, easier to set up?

Not really. I don't know of any better solution which wouldn't require a lot of manual work to keep it working.

Cloudflare actually isn't even very good at identifying bad traffic or delivering on several of its claimed features, but it offers two extremely valuable tools:
 1. It completely blocks even massive IP/UDP/TCP flooding without any thought on the end-user's part. My custom DDoS protection was also able to block these attacks, but it required a significant amount of sysadmin work.
 2. My custom protection failed against layer-7 attacks from 100k+ IPs. To handle these attacks, there needs to be some sort of proof-of-work/CAPTCHA challenge before the application starts making database queries and such. These challenges must exist on servers which will automatically scale to handle any number of requests, as needed. The challenge servers must have the HTTPS key in order to function. It would definitely be possible to do this without something like Cloudflare, and I've posted a general description of how it could be done, but both the coding and sysadmin work are more than I want to deal with.

Cost is a consideration, but not the primary one: I'd consider paying 10-30x more than Cloudflare's $250/mo, if this came with significant improvements. But as far as I know, you don't actually get much more by paying an "enterprise" DDoS protection company $5000/mo than you do by paying Cloudflare $250/mo, and in fact you often seem to get less.

This challenge only comes up when you're using known Tor/Proxy IPs which is usually where DDOS attacks originate from. In terms of L7 attacks, the challenge is what limits its effectiveness before it hits your site. When facing large DDOS attacks or sophisticated ones, you don't have many good options beyond CloudFlare. Privacy is compromised eitherways when traffic has to go through someone else before you.

At least for DDoS by attacker who use Tor network, it can be mitigated by enabling PoW feature.