Re: [tor-dev] Request for feedback/victims: cfc-0.0.2

2016-05-16 Thread David Fifield
On Fri, Apr 01, 2016 at 06:06:18PM +, Yawning Angel wrote: > I'll probably add support for other (user-configurable?) cached content > providers when I have time. The archive.is person doesn't seem to want > to respond to e-mail, so asking them to optionally not set X-F-F, seems > like it'll g

[tor-dev] Request for feedback/victims: cfc-0.0.3

2016-04-18 Thread Yawning Angel
Thanks for the feedback/bug reports so far. [ PEOPLE THAT HAVE BIG SCARY ADVERSARIES IN THEIR THREAT MODEL STILL SHOULD NOT USE THIS. ] This is the third release of the archive.is based captcha-be-gone extension for Tor Browser. Relative to 0.0.2, this has a minor bugfix that fixes URLs wi

Re: [tor-dev] Request for feedback/victims: cfc-0.0.2

2016-04-03 Thread Yawning Angel
On Sat, 2 Apr 2016 18:14:26 -0400 Ian Goldberg wrote: > On Sat, Apr 02, 2016 at 07:19:30PM +, Yawning Angel wrote: > > It's not a request header set by the browser. archive.is is acting > > like a HTTP proxy and explicitly setting X-F-F. > > I wonder what would happen if the browser *also

Re: [tor-dev] Request for feedback/victims: cfc-0.0.2

2016-04-02 Thread Ian Goldberg
On Sat, Apr 02, 2016 at 07:19:30PM +, Yawning Angel wrote: > It's not a request header set by the browser. archive.is is acting > like a HTTP proxy and explicitly setting X-F-F. I wonder what would happen if the browser *also* set X-F-F...? ___ tor-

Re: [tor-dev] Request for feedback/victims: cfc-0.0.2

2016-04-02 Thread Yawning Angel
On Sat, 02 Apr 2016 17:00:10 + ban...@openmailbox.org wrote: > webcitation.org is an archive.is alternative. Potentially it doesn't > forward request headers (?) It's not a request header set by the browser. archive.is is acting like a HTTP proxy and explicitly setting X-F-F. From the FAQ:

Re: [tor-dev] Request for feedback/victims: cfc-0.0.2

2016-04-02 Thread bancfc
On 2016-04-01 18:06, Yawning Angel wrote: On Fri, 01 Apr 2016 18:21:10 +0200 Jeff Burdges wrote: Are there any more sites where CloudFalre appears on archive.is? https://www.aei.org/publication/gen-michael-hayden-on-apple-the-fbi-and-data-encryption/ ​https://archive.is/7u5P8 It's some parti

Re: [tor-dev] Request for feedback/victims: cfc-0.0.2

2016-04-01 Thread Yawning Angel
On Fri, 01 Apr 2016 18:21:10 +0200 Jeff Burdges wrote: > Are there any more sites where CloudFalre appears on archive.is? > > https://www.aei.org/publication/gen-michael-hayden-on-apple-the-fbi-and-data-encryption/ > ​https://archive.is/7u5P8 > > It's some particularly harsh CloudFlare configura

Re: [tor-dev] Request for feedback/victims: cfc-0.0.2

2016-04-01 Thread Jeff Burdges
Are there any more sites where CloudFalre appears on archive.is? https://www.aei.org/publication/gen-michael-hayden-on-apple-the-fbi-and-data-encryption/ ​https://archive.is/7u5P8 It's some particularly harsh CloudFlare configuration perhaps? Jeff signature.asc Description: This is a digita

Re: [tor-dev] Request for feedback/victims: cfc-0.0.2

2016-03-30 Thread Jeff Burdges
I'm impressed with how much nicer the web gets with this. Thank you Yawning! :) On Sun, 2016-03-27 at 06:12 +, Yawning Angel wrote: >* (QoL) Skip useless landing pages (github.com/twitter.com will be > auto-redirected to the "search" pages). Ahh that's why that happened. lol >

Re: [tor-dev] Request for feedback/victims: cfc-0.0.2

2016-03-29 Thread Yawning Angel
On Tue, 29 Mar 2016 10:09:15 +0200 Jens Kubieziel wrote: > * Yawning Angel schrieb am 2016-03-27 um 08:12 Uhr: > >* (QoL) Skip useless landing pages (github.com/twitter.com will > > be auto-redirected to the "search" pages). > > When you're logged into Twitter, https://twitter.com/ shows y

Re: [tor-dev] Request for feedback/victims: cfc-0.0.2

2016-03-29 Thread Jens Kubieziel
* Yawning Angel schrieb am 2016-03-27 um 08:12 Uhr: >* (QoL) Skip useless landing pages (github.com/twitter.com will be > auto-redirected to the "search" pages). When you're logged into Twitter, https://twitter.com/ shows you your stream of tweets. With the current version, a user can't s

[tor-dev] Request for feedback/victims: cfc-0.0.2

2016-03-26 Thread Yawning Angel
Hello, Thanks for the feedback so far. [ PEOPLE THAT HAVE BIG SCARY ADVERSARIES IN THEIR THREAT MODEL STILL SHOULD NOT USE THIS. ] New version with changes some that add functionality, some code of quality stuff, hence a version bump to 0.0.2, especially since it'll probably be a bit befor

Re: [tor-dev] Request for feedback/victims: cfc

2016-03-24 Thread Jeff Burdges
On Wed, 2016-03-23 at 14:09 -0400, Paul Syverson wrote: > On Wed, Mar 23, 2016 at 12:33:15PM -0400, Adam Shostack wrote: > > Random thought: rather than "unreachable from Tor", "unreachable when > > using the internet safely." This is really about people wanting > > security, and these companies n

Re: [tor-dev] Request for feedback/victims: cfc

2016-03-23 Thread Arthur D. Edelstein
On Wed, Mar 23, 2016 at 2:15 AM, Yawning Angel wrote: > My "proof of concept" tech demo is what I consider good enough for > use by brave people that aren't me, so I have put up an XPI package > at: https://people.torproject.org/~yawning/volatile/cfc-20160323/ Very cool! > * If archive.is is e

Re: [tor-dev] Request for feedback/victims: cfc

2016-03-23 Thread Paul Syverson
On Wed, Mar 23, 2016 at 12:33:15PM -0400, Adam Shostack wrote: > Nice! > > Random thought: rather than "unreachable from Tor", "unreachable when > using the internet safely." This is really about people wanting > security, and these companies not wanting to grapple with what their > customers wan

Re: [tor-dev] Request for feedback/victims: cfc

2016-03-23 Thread Griffin Boyce
Yawning Angel wrote: Inspired by https://trac.torproject.org/projects/tor/ticket/18361 I've been working on way to improve the situation. Neat. In the thread someone mentions that it's possible to derive the answer for the old-style street number captchas using tesseract [1]. Interestingly,

Re: [tor-dev] Request for feedback/victims: cfc

2016-03-23 Thread Adam Shostack
Nice! Random thought: rather than "unreachable from Tor", "unreachable when using the internet safely." This is really about people wanting security, and these companies not wanting to grapple with what their customers want. On Wed, Mar 23, 2016 at 05:31:50PM +0100, Jeff Burdges wrote: | | Tha

Re: [tor-dev] Request for feedback/victims: cfc

2016-03-23 Thread Jeff Burdges
Thank you, Yawning! This looks great. :) I think Kate was planning on writing up an official position of the Tor project on the CloudFlare situation. Amongst other things, it's expected to contain several strong arguments for convincing sites that the CAPTCHA does them no good and to make the

Re: [tor-dev] Request for feedback/victims: cfc

2016-03-23 Thread David Fifield
During the OONI survey to find instances of server-side Tor blocking, we found a few variations on CloudFlare captcha pages. They don't all say "Attention Required!". Apparently there is an option to customize the page, but few sites make use of it. Here are the regexes we used (excerpted from http

Re: [tor-dev] Request for feedback/victims: cfc

2016-03-23 Thread Yawning Angel
[I hate replying to myself.] On Wed, 23 Mar 2016 09:15:36 + Yawning Angel wrote: > My "proof of concept" tech demo is what I consider good enough for > use by brave people that aren't me, so I have put up an XPI package > at: https://people.torproject.org/~yawning/volatile/cfc-20160323/ I no

[tor-dev] Request for feedback/victims: cfc

2016-03-23 Thread Yawning Angel
Hello, Inspired by https://trac.torproject.org/projects/tor/ticket/18361 I've been working on way to improve the situation. My "proof of concept" tech demo is what I consider good enough for use by brave people that aren't me, so I have put up an XPI package at: https://people.torproject.org/~yaw