How Tor stopped DDoS and how cf could too

https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/

If a lot of requests are made, Tor does a PoW challenge, the PoW adapts to the amount of requests being made, the source code is already public and has been audited, please cf implement this. You would solve DDoS once and for all.

Introducing Proof-of-Work Defense for Onion Services | Tor Project

Today, we are officially introducing a proof-of-work (PoW) defense for onion services designed to prioritize verified network traffic as a deterrent against denial of service (DoS) attacks with the release of Tor 0.4.8.

! SAKURA.sx❁OP•1/3/24, 12:14 PM

If attackers attempt to flood an onion service with requests, the PoW defense will kick into action and increase the computational effort required to access a .onion site. This ticketing system aims to disadvantage attackers who make a huge number of connection attempts to an onion service. Sustaining these kinds of attacks will require a lot of computational effort on their part with diminishing returns, as the effort increases.

Original message was deleted

! SAKURA.sx❁OP•1/3/24, 2:35 PM

Tor's PoW defense is a dynamic and reactive mechanism, remaining dormant under normal use conditions to ensure a seamless user experience, but when an onion service is under stress, the mechanism will prompt incoming client connections to perform a number of successively more complex operations. The onion service will then prioritize these connections based on the effort level demonstrated by the client. We believe that the introduction of a proof-of-work mechanism will disincentivize attackers by making large-scale attacks costly and impractical while giving priority to legitimate traffic.

Original message was deleted

! SAKURA.sx❁OP•1/3/24, 2:38 PM

And how could it be bypassed? This been proposed years ago, no one has been able to find a bypass in that time

! SAKURA.sx❁OP•1/3/24, 2:45 PM

The same way as UAM, but less intrusive, faster and automatic

! SAKURA.sx❁OP•1/3/24, 2:49 PM

The only part that it wouldn’t fix are APIs without previous browser access on that domain, but that is not very common

! SAKURA.sx❁OP•1/3/24, 2:50 PM

But it is not the same comparing traffic and individual websites

! SAKURA.sx❁OP•1/3/24, 2:51 PM

Most api websites are big

Original message was deleted

! SAKURA.sx❁OP•1/3/24, 2:53 PM

Cloudflare can protect them in other ways, the tor solution is not perfect, but it works for most websites

Cyb3r-Jak3•1/3/24, 4:38 PM

I'm confused on how this helps Cloudflare? This is something specific for tor and the onion network

CCyb3r-Jak3 I'm confused on how this helps Cloudflare? This is something specific for tor an...

! SAKURA.sx❁OP•1/3/24, 4:44 PM

It could be aplied to cf too

Cyb3r-Jak3•1/3/24, 4:51 PM

Like with their onion routing?

! SAKURA.sx❁OP•1/3/24, 5:12 PM

No, the PoW model

! SAKURA.sx❁OP•1/3/24, 5:13 PM

Yes, but not progressively

! SAKURA.sx❁OP•1/3/24, 5:15 PM

If a challenge takes half a second, the amount of power needed to attack a website becomes almost impossible for 99% of thread actors

!! SAKURA.sx❁If a challenge takes half a second, the amount of power needed to attack a websi...

! SAKURA.sx❁OP•1/3/24, 5:17 PM

The cost added is astronomical, with the same hardware you could do 100000 RPS, you can only do 100 with that kind of PoW

Original message was deleted

! SAKURA.sx❁OP•1/3/24, 5:18 PM

Well, it works based on numers, you put a number that your backend can handle, if the attack is bigger than the number then there is a PoW, if the attack is still bigger, there is a bigger PoW and so on

! SAKURA.sx❁OP•1/3/24, 5:19 PM

The PoW is the minumum needed for the attack to stop, and if the attacker has bigger hardware, the PoW becomes bigger

Original message was deleted

! SAKURA.sx❁OP•1/3/24, 5:21 PM

But that would requiere cf automatically challenging the bad requests

! SAKURA.sx❁OP•1/3/24, 5:22 PM

The problem is that requests are challenged individually, so they are treated the same way when there is an attack than where there isn't

Original message was deleted

! SAKURA.sx❁OP•1/3/24, 5:23 PM

I have recieved a lot of attacks, cf doesn't challenge all the requests when there is an attack

! SAKURA.sx❁OP•1/3/24, 5:23 PM

I think the most important thing from the Tor implementation is automatically activating it

! SAKURA.sx❁OP•1/3/24, 5:24 PM

Cf UAM is great, but it would be 100 times better if it activated automatically when there is an attack

Original message was deleted

! SAKURA.sx❁OP•1/3/24, 5:24 PM

That's the problem

Original message was deleted

! SAKURA.sx❁OP•1/3/24, 5:26 PM

Well, would it really be difficult to have a config option where you can set an amount of requests that if surpassed activates cf UAM?

Original message was deleted

! SAKURA.sx❁OP•1/3/24, 5:27 PM

Indeed, cf already does that, cf sends notifications when there is an attack

!! SAKURA.sx❁Indeed, cf already does that, cf sends notifications when there is an attack

! SAKURA.sx❁OP•1/3/24, 5:28 PM

Would it be hard to have an option where when this happens, UAM is activated?

! SAKURA.sx❁OP•1/3/24, 5:34 PM

I don't think it would be too hard, and it would be a life saver for a lot of people, every time I see a site that has UAM activated at all times, it makes me think about all the time and bandwidth and electricity wasted by doing challenges when the site is not under attack, please consider this

How Tor stopped DDoS and how cf could too

Similar Threads

Similar Threads

Similar Threads