CloudFlare, the website protection service, and The Onion Router or Tor have locked horns with each other, and are now blaming and hurling accusations of incompetency at the each other.
CloudFlare has come under fire from Tor for deploying a flawed methodology due to which maximum requests from the latter end up getting blocked. For the unfamiliar, Tor offers a Web browser that enables people to surf anonymously online.
On March 31, CloudFlare asserted that a bulk of Tor's network requests were malicious. The website security provider also claims in its report that Tor is used for phishing and scamming activities.
"Based on data across the CloudFlare network, 94 percent of requests that we see across the Tor network are per se malicious," said CloudFlare. "A large percentage of the comment spam, vulnerability scanning, ad click fraud, content scraping, and login scanning comes via the Tor network."
Tor has claimed that its IP addresses are blocked from reaching sites that are under the CloudFare system and that the latter's assertions need to be backed up with evidence.
"Wednesday, CloudFlare blogged that 94 percent of the requests it sees from Tor are 'malicious.' We find that unlikely, and we've asked CloudFlare to provide justification to back up this claim. We suspect this figure is based on a flawed methodology by which CloudFlare labels all traffic from an IP address that has ever sent spam as "malicious." Tor IP addresses are conduits for millions of people who are then blocked from reaching websites under CloudFlare's system," countered Tor.
CloudFlare has based its findings on data garnered by observing the requests made by different IP addresses across its network, as well as determining the extent to which these requests were possibly malicious. The security service emphasized that since its customers sign-up for CloudFlare so they can be protected against online attacks, the company cannot bypass security under any circumstance.
The service is of the belief that anonymity is necessary and, therefore, it is left with the option of sacrificing certain conveniences for Tor browser users. Dealing with this issue has been challenging for the service and in the near future, CloudFlare intends to give its human/bot authentication system in Tor's hands.
The company is also optimistic that it will be able to develop .onion variants of the websites of CloudFlare customers. These would only be accessed through Tor and the traffic to the .onion websites will be encrypted through SSL.
