123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326 |
- Audience: General, people who stumble upon gnu.org
- 1924+/-395 words english
- 1028+/-395 words instead?
- 755 words rahisibhasha
- stab at french
- Version: 2019-05-29
- #########################################
- 大云墙 (Dà Yún qiáng)
- 大きな雲壁 (Ookina Kumo kabe)
- The Great Cloudwall
- by Jeff Cliff
- essistensa una reason you go to
- #########################################
- There is a reason that none of your favourite work has appeared on Tor since early 2016[15].
- That reason has lead to the discovery of a threat to the operation of the World Wide Web.
- Prerequisites:
- - The JavaScript Trap[47]
- - Understanding that Google is not to be trusted[45][46]
- - Nick Szabo: "Trusted Third Parties are Security Holes"[44][48]
- Cloudflare is a network service for turing tests its users use against visitors, which means that it frustrates attempts
- by users of its users to develop software to interact with their websites[3].
- This might seem strange at first - why would you need a program to access a web resource?
- But there's many things that work on the web like this, including RSS, streaming, chat, podcasts, and anti-virus definitions[57][58] which
- are completely broken by a CAPTCHA appearing mid stream[11].
- "We humans don't make HTTP requests, our machines to do it for us."
- This makes clear what is really being tested here - whether or not you have the right software stack in between you and
- Cloudflare.
- This is not hypothetical: Cloudflare is currently attempting to dictate which browsers users of their "protected"
- websites may use[60].
- {{expand}}
- Your right to use Free Software in this stack is at risk and could disappear at any moment.
- It also is extracting free labor from website users[35], in effect tricking humans into acting like robots in order to
- pass a test designed to see whether or not they are a robot. Worse, this labor is being used to train[62] Google's artificial intelligence, a very
- poor candidate for "friendly AI"[36]. Given unfriendly AI is an existential[43] risk[42] to mankind, avoiding this
- should be among the highest of priorities.
- This software stack includes human language: the CAPTCHAs are in English, leaving non-English speakers around the world
- at a disadvantage[13]. Attempts to fix this are bound by the fact that they also leak language information to
- Cloudflare[21].
- Furthermore, they use Google's reCaptcha for their turing test/"proof you are a human" challenge and Google is known as a part of NSA's PRISM surveillance project so they expose their website visitor's data to PRISM data collection.
- On its own, this is terrible bad but it's also worth pointing out how the reCAPTCHAs work. It isn't by whether or not you
- click on the correct icon (though that is a factor too) but also collect:
- > mouse movement, its slightness and straightness
- > page scrolls
- > time intervals between browser events
- > keystrokes
- > click location history tied to user fingerprint
- > device information
- > All these criteria are stored in the browser’s cookie and are processed by Google’s servers
- > It should be emphasized that there is DARPA technology to identify people by mouse movements and typing
- [23]
- This collection of data is likely illegal in regions where privacy is taken seriously (like the EU)[24].
- It is frustrating even when it works because you have to fill out 20 captchas on the off-chance that you succeed one time in
- twenty. So this is 95% censorship and 5% wasting users' time[5].
- More important, though, is that it starts to form a ratchet for web browser technology; the captchas are upgraded all the
- time and if you use an older browser, you risk being left behind even when it works.
- *How Cloudflare Threatens You*
- "When you fetch a page from a website that is served from Cloudflare, JavaScript has been injected on-the-fly into that
- page by Cloudflare. And they also plant a cookie that brands your browser with a globally-unique ID. This happens even if
- the website is using SSL and shows a cute little padlock in your browser" [10]
- - Cloudflare tracks you
- Even if your traffic is protected from onlookers, Cloudflare itself can see your traffic[6] because they are a MITM[14][31].
- In addition, if Cloudflare[53] has intercepted your traffic(MITM), so has the NSA[33].
- "If a site uses Cloudflare, then the browser lock icon is a false promise."[14]
- "The short version, a rhetorical question: Would you trust a key escrow regime, in which an “authorized” entity was
- entrusted with the potential to decrypt all communications at will? If not, why would you trust a de facto mass decryption
- chokepoint at which many communications are actually decrypted?"[34]
- In other words,
- - They are in a position to track, tap, and link Internet activity across a wide range of sites. [14]
- - Cloudflare frustrates accessibility efforts[25][27][36]:
- "CAPTCHA remains the most problematic item indicated by respondents"
- Cloudflare is one of the largest, if not the largest source of unconsensual CAPTCHAS, making them quite possibly the
- biggest impediment in accessibility efforts worldwide.
- - Cloudflare makes using Tor frustrating by making efforts to become anonymous more difficult and making it more likely
- that people will use non-Tor connections for some or all of their web browsing. The problem is getting worse with time.
- [13]
- - It's not just Tor[19] but Tor users are the biggest group of people who've noticed it and are organizing against it so
- far.
- - In particular, the model of Project Honeypot depends on one IPv4 address, meaning one person. As IPv4 addresses become
- scarce, more and more ISPs (and whole countries[22]) are forced to use higher and higher levels of NAT. The result is that
- the kinds of treatment of Tor users by Cloudflare starts to be not just for Tor, but for all web users. "Tor is just being
- slightly ahead of what the IPv4 Internet is going to look like pretty soon."
- The next time a large group wakes up, millions of websites might be down (including critical ones) across a whole
- continent. This has actually happened already. [49]
- "It was made clear in the Snowden leaks that GCHQ, the NSA, etc. would like people to stop using Tor so I am sure they are
- very happy to see CF make general web browsing difficult and frustrating for ordinary users." [12]
- - Worse, Cloudflare makes using Tor *dangerous* because enabling JavaScript and images to deal with their system makes it
- likely that some people will enable JavaScript and images on other websites, which, even if Cloudflare wasn't threatening
- them, would. [9]
- - Cloudflare is capable of tracking users of its websites, and initial looks into its JavaScript/CAPTCHA seems to bear out
- that they are doing so.
- - Cloudflare can target individual users with JavaScript malware; since you typically wind up enabling their JavaScript
- to use websites, you fall into their trap. Because they track users, are giving, individualised code, and work directly
- with the US government/DHS, there's no reason why they can't tailor attacks to specific users.
-
- - Even if they aren't doing it yet, they are at any point one US government administration, one vulture capital funding
- purchase[26], or one internally rogue element away from executing JavaScript code on hundreds of millions of people's
- computers a "highly attractive" target[7] with no oversight. The code CAPTCHA itself protects attempts to detect such
- things from happening.
- - The way that Cloudflare is constructed means that even by accident, billions of people can be analyzed by their
- government[51] and have their access limited or completely cut off at the government's whim.
- *Background : How Cloudflare threatens the web*
- - Cloudflare is a MITM for the whole web
- - As of 3 years ago 10% of the top 25,000 websites used Cloudflare[2]
- - A billion people in china are restricted by the Great Firewall[8]. Anyone who goes so far as to circumvent that must then
- deal with the "Great Cloudwall" for accessing the open internet.
- - This is not just an individual problem, but fundamentally threatens the ecosystem of the web.
- Cloudflare is breaking the open internet one site at a time. The web is massively resilient - we can do without Stack
- Overflow, GNU.org or even Google but when a significant enough portion of websites use a single provider, there starts to
- be a systematic risk that if that single provider goes down, all of the websites behind it will be inaccessible. Worse, you
- won't be allowed to access it unless you have the right kind of US government approved credential, contingent, perhaps, on
- running software only they approve of.
- It is becoming a single point of failure for the internet. [39]
- Right now, there are alternative sources for, for example, the US constitution[17]. It is not unthinkable that Cloudflare
- is getting big enough to threaten even that.
- {FIX ME - make section clearer}
- "A.1 sometimes there are necessary websites for some degree of necessary. Government websites, public service, etc. How
- long until those are behind the "Great Cloudwall"?
- B: Not long. Our service is competitive and convenient. If public service websites choose to use our service for awesome
- DDoS protection, it's their choice."[36]
- - Cloudflare has already started down the slippery slope[52] of censoring websites. If they didn't have a stranglehold on
- people accessing the internet, it would not be a problem. They are big enough that censorship from Cloudflare is starting
- to be a systematic exclusion from the political process.
- "Cloudflare is perfect: it can implement censorship on the fly without anyone getting wise to it!"[40]
- - DNS[39]: given that they have become so systematically powerful, the next step to cementing their power is to attack
- DNS. Their 1.1.1.1 DNS server, like Google's 8.8.8.8, is marketed to people so that Cloudflare will still be able to see
- you're going to them even if you don't interact with websites "protected" by them. It gives them even more data to track you
- with.
- *Background : Where does Cloudflare come from?*
- Cloudflare comes from a project called "Project Honey Pot"[61], originally intended to track online fraud and abuse.
- "What was Project Honey Pot?
- 'A service that positions itself as some kind of a grassroot-y anti-spam registry, but in reality seems to be a pro-
- corporate law enforcement tool with the specific aim of entrapping and prosecuting spammers/phishing scammers in a way
- that’s friendly to the marketing industry.'"
- The US Department of Homeland Security approached the developers in 2007-8[1][36] for access to their data and they have
- been working with the US government[54] and law enforcement ever since[1].
- On HTTP GET requests:
- Cloudflare has a history of shutting down open DNS and open NTP servers.
- "It would be great if they allowed GET requests - for example - such requests should not and generally do not modify server
- side content. They do not do this - this breaks the web in so many ways, it is incredible. Using wget with Tor on a website
- hosted by CF is... a disaster. Using Tor Browser with it - much the same. These requests should be idempotent according to
- spec, I believe."
- {FIX ME - "critical of it"?}
- Cloudflare has a history of closing tickets that are critical of it without actually resolving the issue[29][30][32]
- "Cloudflare is based in a country with secret courts, secret police, and secret prisons that are above the law - and this
- secret government has characterized Cloudflare's data as extremely valuable"[28]
- "The CEO says, "Cloudflare's strength lies in the DATA it collects -- not in its CODE.'"[28]
- "The U.S. federal government is a Cloudflare customer."[28]
- "Cloudflare has never stated that a government agency did not install wiretapping equipment or software on the same
- premises as a Cloudflare server."[28]
- "Cloudflare has never indicated that the architecture of its content distribution network is resistant to warrantless
- mass surveillance."[28]
- "Cloudflare has given the Chinese government unprecedented censorship capability."[28]
- "Cloudflare has no intention to shut down as Lavabit did in order to protect the user from unlawful surveillance."[28]
- "Some Cloudflare customers are paying over 1 million dollars per year for an undisclosed service."[28]
- *"But Cloudflare is really necessary, the web is a nasty place"*
- - The more of the web is held within Cloudflare, the more pressure will be on websites not behind Cloudflare
- - As of 2016, by Cloudflare's own data, Tor was not as bad as normal internet connections.
- - People: "But we need Cloudflare to protect us from DDoS.”
- Cloudflare: "That’s a nice site you have there. It would be a shame, such a shame, if anything happened to it. Why don’t
- you let us decrypt all your TLS sessions[59] so we can protect you?"[14]
- *I heard Cloudflare is working with Tor and all is good now?*
- - Just because you can't see the problem doesn't mean it's not there.
- - This is not true. Their websites still CAPTCHA their users, same as ever, and news agencies across the political spectrum
- screwed up stories about how the 'problem is fixed'. [18]
- - It's actually worse, though[17], if we couldn't see it[60] - it was easy to get a lot of riled up Tor users to understand
- that Cloudflare was their adversary. It's a lot harder to convince people who are not blocked from their websites, today,
- why giving systematic control over the world wide web might be a bad thing tomorrow.
- "Right now, Cloudflare says it monitors nearly 1/5 of all Internet visits. An astounding claim for a company most people
- haven’t even heard of"[40]
- - But they are now doing more to track users and threaten the anonymity of Tor users.
- - Cloudflare is one of a couple of large network providers that are capturing the vast majority of digital communications,
- effectively creating private networks the size of the modern internet that are competitive with and not subject to the
- same kinds of scrutiny and regulation as the internet[58].
- *What if we shut down Cloudflare and migrate all websites out of them?*
- We're probably going to have the same problem with another company very soon. Just as when suddenly Microsoft no longer had
- a monopoly on software, we didn't get rid of the problem of proprietary software, there's a couple of problems that, if we
- don't solve them, something like Cloudflare is roughly inevitable as a consequence:
- *Cloudflare DNS*
- "DNS[50] is around, servers are insecure, proper end-to-end crypto isn't the norm hence MITM goes unnoticed, anonymity is an edge case, routing lacks built-in resiliency to disruption, we're always going to have actors building a business model around cobbling together superficial, overapproximating mitigations."[20]
- *Mozilla and Cloudflare*
- "At least for browsing with Firefox, because Mozilla has partnered up with Cloudflare and will resolve the domain names
- from the application itself via a DNS server from Cloudflare based in the United States. Cloudflare will then be able to
- read everyone's DNS requests."
- Sharing DNS requests with Cloudflare represents mozilla having a security hole, straight to the Cloudflare (and probably:
- the NSA).
- *What can you do?*
- Learn more about Cloudflare and make sure the people around you know about Cloudflare. Use Tor by default to be more
- exposed to the blocks. Go to the anti-Cloudflare collaboration repository[41] and make sure websites you use aren't
- "protected", and if they are, contact the people who run the website requesting that they no longer use Cloudflare. Get
- involved!
- References
- [1] crimeflare. Is CloudFlare a honey pot? https://web.archive.org/web/20170721161127/http://www.crimeflare.us/honeypot.html
- [2] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:15
- [3] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:21
- [5] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:28
- [6] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:30
- [7] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:32
- [8] ioerror. Issues with corporate censorship and mass surveillance. https://www.bloomberg.com/quicktake/great-firewall-of-china
- [9] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:51
- [10] crimeflare. Is CloudFlare a honey pot? https://web.archive.org/web/20170721161127/http://www.crimeflare.us/honeypot.html
- [11] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:59
- [12] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:66
- [13] mikeperry. The Trouble with CloudFlare. https://blog.torproject.org/trouble-cloudflare
- [14] nullius. Block Global Active Adversary Cloudflare. https://trac.torproject.org/projects/tor/ticket/24351#comment:8
- [15] Unknown. Google+ https://plus.google.com/105395547687614433866/posts/G9nnQBnLtjp
- [16] Unknown. Google+ https://plus.google.com/105395547687614433866/posts/XnQryQ7hR9G
- [17] msmach. Cloudflare Ends CAPTCHAs For Tor Users https://it.slashdot.org/comments.pl?sid=12641622&cid=57348584
- [18] msmach. Cloudflare Ends CAPTCHAs For Tor Users https://it.slashdot.org/comments.pl?sid=12641622&cid=57388544
- [19] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:90
- [20] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:112
- [21] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:132
- [22] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:141
- [23] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:147
- [24] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:160
- [25] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:175
- [26] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:183
- [27] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:231
- [28] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:236
- [29] ioerror. Issues with corporate censorship and mass surveillance. https://trac.torproject.org/projects/tor/ticket/18361#comment:255
- [30] gk. Cloudflare breaks loading the chat. https://trac.torproject.org/projects/tor/ticket/23141
- [31] nullius. Block Global Active Adversary Cloudflare. https://trac.torproject.org/projects/tor/ticket/24351#comment:20
- [32] nullius. Block Global Active Adversary Cloudflare. https://trac.torproject.org/projects/tor/ticket/24351#comment:44
- [33] nullius. Block Global Active Adversary Cloudflare. https://trac.torproject.org/projects/tor/ticket/24351#comment:52
- [34] nullius. Block Global Active Adversary Cloudflare. https://trac.torproject.org/projects/tor/ticket/24351#comment:60
- [35] nullius. Block Global Active Adversary Cloudflare. https://trac.torproject.org/projects/tor/ticket/24321#comment:13
- [36] Anonymous. Cloudflare philosophy. https://codeberg.org/crimeflare/stop_cloudflare/src/master/cloudflare-philosophy.md
- [37] Peter O'Shaughnessy. Screen Reader User Survey Results #7. https://toot.cafe/@peter/99398584471715976
- [39] ungeich. A new feature in Firefox https://blog.ungleich.ch/en-us/cms/blog/2018/08/04/mozillas-new-dns-resolution-is-dangerous/
- [40] Yasha Levine. iSucker: Big Brother Internet Culture http://exiledonline.com/isucker-big-brother-internet-culture/
- [41] Anonymous. The Great Cloudwall. http://codeberg.org/crimeflare/stop_cloudflare
- [42] lesswrong wiki. Unfriendly artificial intelligence https://wiki.lesswrong.com/wiki/Unfriendly_artificial_intelligence
- [43] Ben Harack. What is an existential risk? https://www.visionofearth.org/future-of-humanity/existential-risks/what-is-an-existential-risk/
- [44] Nick Szabo. Twitter http://twitter.com/nickszabo4
- [45] FSF. Google's Software is Malware https://www.gnu.org/proprietary/malware-google.en.html
- [46] Richard Stallman. Reasons not to use Google https://stallman.org/google.html
- [47] Richard Stallman. The JavaScript Trap https://www.gnu.org/philosophy/javascript-trap.html
- [48] Nick Szabo. Trusted Third Parties are Security Holes. 2001. https://nakamotoinstitute.org/trusted-third-parties
- [49] slashgeek. CloudFlare is ruining the internet (for me) https://www.slashgeek.net/2016/05/17/cloudflare-is-ruining-the-internet-for-me/
- [50] Hamid Sarfraz. How likely is it that CloudFlare is an NSA operation? https://www.quora.com/How-likely-is-it-that-CloudFlare-is-an-NSA-operation/answer/Hamid-Sarfraz
- [51] Karthik Balakrishnan. Airtel is sniffing and censoring CloudFlare’s traffic in India and CloudFlare doesn’t even know it. https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98
- [52] http://pleroma.oniichanylo2tsi4.onion/notice/1563
- [53] StopMITMInt. Add an option to stop trusting Cloudflare certificate https://github.com/mozilla-mobile/focus-android/issues/1743#issuecomment-351555735
- [54] goody2shoes. Block Global Active Adversary Cloudflare https://lists.torproject.org/pipermail/tor-talk/2018-January/043889.html
- [55] EFF. The Crypto Wars https://www.eff.org/document/crypto-wars
- [56] http://forums.clamwin.com/viewtopic.php?t=4915
- [57] November 2018 Archives by thread http://lists.clamav.net/pipermail/clamav-users/2018-November/thread.html
- [58] https://www.itu.int/en/ITU-T/Workshops-and-Seminars/20181218/Documents/Geoff_Huston_Presentation.pdf
- [59] Thorin-Oakenpants. let's talk about our little buddy cloudflare. https://github.com/ghacksuserjs/ghacks-user.js/issues/310#issuecomment-351913412
- [60] ghost. What do you think about Cloudflare? https://github.com/privacytoolsIO/privacytools.io/issues/374#issuecomment-460413259
- [61] Unspam Technologies, Inc. https://projecthoneypot.org/
- [62] TechRader. Captcha if you can: how you’ve been training AI for years without realising it https://www.techradar.com/news/captcha-if-you-can-how-youve-been-training-ai-for-years-without-realising-it
|