Opened 8 months ago

Last modified 7 months ago

#33450 assigned enhancement

Create a guide to help web site owners mitigate abuse from Tor without blocking non-abusive Tor users

Reported by: jnewsome Owned by: ggus
Priority: Medium Milestone:
Component: Webpages/Support Version:
Severity: Normal Keywords:
Cc: traumschule, trac-dip-importer, ggus, docshackathon Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Specifically we need something that a blocked Tor user can point a site/service owner to. Today the most discoverable version of this on the main site is https://support.torproject.org/#censorship-2, which essentially boils down to just asking the owner to not block Tor out of altruism, without offering any technical detail or support.

Ideally such a page would help the owner determine how they're blocking Tor users in the first place (CDN configuration? Firewall? Website plugin?), and help them understand what their alternatives are.

As a first pass, such alternatives might include:

1) If the traffic isn't known to actually be causing harm, just don't block it. This may be the right solution if the exit node(s) were being blocked based on volume of traffic rather than any actual problem that traffic was causing. If there's a per-IP-address rate limit, consider raising it for known exit nodes.

2) Slowing down abusive Tor users by blocking Tor circuits, e.g. using CloudFlare's onion integration or
https://github.com/alecmuffett/eotk.

3) PrivacyPass or other proof-of-work per browser rather than per IP address.

4) Application-level mitigations.

Child Tickets

Change History (3)

comment:1 Changed 8 months ago by pili

Component: Webpages/WebsiteWebpages/Support

comment:2 Changed 8 months ago by pili

Owner: changed from hiro to ggus
Status: newassigned

comment:3 Changed 7 months ago by ggus

Cc: docshackathon added
Type: defectenhancement
Note: See TracTickets for help on using tickets.