Tor use is now forbidden on Kimsufi's OVH(forum.ovh.com) |
Tor use is now forbidden on Kimsufi's OVH(forum.ovh.com) |
I'm an admin on a social/gaming site (a MUD with appendant forum, blogs, and other community elements), and we have had to make a few decisions about Tor in the last couple of years.
Some background: the site is quite old, and we have historically encouraged users to sign up without needing to provide a unique ID such as email address. They can provide one, but don't have to. In the last few years we have had the problem of occasional griefers log on and cause whatever social havoc they can.
Now, my personal feelings about Tor are generally quite positive, and I like the freedoms it provides people who are otherwise restricted by their ISPs or governments from accessing legitimate resources. Like many others have said, Tor is a tool that, while it can be used to do illegal things, is also used to provide a very useful service to people who need it to get on with things you and I take for granted.
Now, back to our griefers: We have a number of banning mechanisms based on IP or domain, and they tend to be successful because griefers usually get bored when they can't access the site for a couple of hours. However, because a tiny minority of griefers are more persistent, more technically adept, and figured they could use Tor to damage our community, we did a little bit of analysis and found that few if any legitimate users of our site came from Tor exit points, and we chose to block them. The alternative was to require a unique identity during the sign-up process, and frankly we wanted as few hurdles as possible to new users (anyone who knows the MUD community knows that it's in decline, and low-friction signups are pretty desirable). So we blacklist Tor exit points from our signup process. The unfortunate fact is that some Tor users do bad things with the fantastic tool at their disposal, and end up spoiling it for the legitimate (and extremely valuable) use cases that make it such an amazing tool. Yet its very anonymity means that there is no easy way to allow one set of uses while disallowing others. This is a hard problem, and one I'm not smart enough to solve.
Freenode does something similar - tor and other problematic traffic sources can connect but must use connect time SASL to authenticate to a previously created account, which is sufficient to exclude the vast majority of the griefers.
Having said that, I'm currently trying to make a point of using TOR for regular and mundane uses - particularly if using government sites - just to increase the amount of "legitimate" tor traffic. I'm also (carefully) intentionally de-anonymising myself while using tor like this - identifying myself to local government websites while doing "ordinary" things while connected over TOR - I booked an extra trash collection recently for example. I don't suppose my local council website managers even notice, but I like to think my local PRISM equivalent operators see traffic like this and think "WTF?" ;-)
(But like the parent-poster, I've suffered forum-trolls, and given the time and skill poor nature of most forum owners, the obvious "just ban free email accounts/tor/cellular-ip signups" is often the right, if overly broad hammer.)
Did you try the other approach taken by many sites of making their posts/activity hidden from others? Initially they can't tell the difference between being ignored and being hidden. It also has the advantage that if they were incorrectly hidden you can turn it off and their activity is still present.
Basically, the client and the machine hosting the hidden service both connect to a rendevouz point and communicate via that. The connections to the rendevouz point are not direct. They are bounced through three nodes, with three layers of encryption, each node being able to peal off one layer before passing it on to the next.
This is why hidden services are pretty slow. Every packet has to be routed through 6 other machines, which each can be anywhere in the World.
My (amateur) translation, cleaning up Google translate (which doesn't recognize Tor as a proper name): "For several months, we've had many legal matters related to the use of TOR networks in pedo cases, and from now on, it is forbidden along with all systems of anonymization."
Doesn't sound like they want any part of it.
Your translation is correct though.
It looks like anything looking like a proxy is forbidden now. Including tor nodes :/
Ran a middle (non entry/exit) Tor node on one of their servers, received an automated "Abuse message"...
Wrote a support ticket regarding some network architecture question, got a one-liner "not possible".
I tried but failed to sign up for one of their 3 euro/month servers a few days back in response to other HN discussion (their .uk site wont accept Australian addresses, and their .com site doesn't have those inexpensive 1G servers).
The main reason I would have got the would have been to use as a non-US based VPN endpoint. (I'm somewhat less satisfied with my DigitalOcean droplet as a VPN endpoint since Snowden's revelations.)
I'm not complaining, nor have I seen better.
They're totally horrible to deal with, unless you make minimum wage you're probably going to spend more on packets of Tylenol due to all the headaches they cause than what you're going to save.
Running Tor relays is one of the reasons I use their servers...
"starting a few months back, we've had an number of legal cases regarding the use of multiple TOR networks for pedo, and we will forbid its use from now on, the same way we forbid all anonymisation systems. It raises the number of fraudulent uses of our network and the number of subpoenas each month"
I guess it means both.
7.4 For security reasons, all IRC services (for non-exhaustive: bots, proxy, bouncer, etc..), anonymous browsing services (usually called proxies), TOR nodes, are not allowed on the OVH network unless written consent of OVH. OVH reserves the right to suspend any server which these elements are used without prior permission of OVH.
Server host OVH warns of 'multi-stage' hacking attack. http://www.theregister.co.uk/2013/07/23/top_server_host_ovh_...
Not to mention annoyance for the user... there will be sites you can't access since many sites block exit node IPs outright because of abuse.
If some random does something illegal and they happen to be using your node, guess who gets the knock on the door?
With that in mind, what user would want to operate an exit node?
Once you get your home or server IPs connected to black market forums, drugs, human trafficking or kiddie porn sites and your life (and your family's) has suddenly become more complicated, I wonder how many will still be eager to run Tor exit nodes? Maybe a few dreamers and anarchists.
Tor exits will be shut down one by one, either by the owners or by the police/state.
What we need to come up with is a fully encrypted, anonymous, self-contained super-internet of something like Tor "hidden services" only.
So all they interact with (and can disturb the world of) is other griefers?
His story in french: http://www.capital.fr/enquetes/hommes-et-affaires/octave-kla...
The first interview I ever heared from him, on a french radio/Tv: http://www.bfmtv.com/video/bfmbusiness/it-for-business-lhebd...
His views on the french state subsidized cloud attempts: http://pro.01net.com/editorial/584765/octave-klaba-un-fourni... "That is not enough to put on the table a big amount of money."
http://www.vaporcloud.info/ "Vous aussi vous en avez marre des annonces franco-françaises autour du Cloud financé par l'argent public ? Adoptez le Cloud français d'OVH.com. "
His twitter with nice pictures of OVH infrastructures: https://twitter.com/olesovhcom
Keep on Oles!
Well, when it's not a hidden service, it's the exit node that gets to see the contents of the message before sending it (unless it's SSL of course) to the wider Internet. If there was a unique ID within the Tor network, no one on the wider Internet would be able to see it. My thought was that if you were connecting directly to a hidden service within the Tor network, there might be a unique ID. Sounds like even connecting to hidden services within the Tor network is done indirectly.
The only people who suffer from the loss of Tor exit nodes are the 'more genuine' or 'more worthy' users who need to use it to escape oppression, or state monitoring.
Their ordering process is painful. Their online management interface is atrocious. Communication is poor.
It's true what they say about paying peanuts...
I'm a long time OVH customer and I can ensure you that your contract term will start only when you get your server.
As far as I know the first 1000 "3euros" servers got sold faster than they thought. Now they are building new ones. Be patient, your server is coming. ;-)
I never use my main email for anything I don't feel requires it, and while maininator.com is often blocked, I've never in my life had to refresh the mailinator page more than twice for an alternate domain that works. Since mailinator accepts email from any domain that has it's MX record set to it, if you own a domain you can set it to be an alternate name to mailinator in seconds. Enough people have done this.
Heck you can just write a script to refresh the mailinator.com homepage to start pulling out domains to block: @veryrealemail.com, @chammy.info, @mailinator2.com, @spamthisplease.com, @sogetthis.com, @mailinator.net, @binkmail.com, @sendspamhere.com, @spamherelots.com, etc.
All of the people who have already been running exit nodes for years? Those who don't mind getting that terrible knock on the door? Those who have already had that knock on their door, sometimes more than once, but who live in locations where they don't need to fear their local police?
what user would want to operate an exit node?
"both the client and the hidden service establish a three hop circuit to the same tor relay, where the connections are joint, so hidden services will have even double the delay of normal tor traffic. If relays were homogeneous distributed among the globe, two random relays will be 1/4 earth circumference apart on average. This means that a round trip will have a speed of light delay of 12 hops * 10 000km each / 300 000 km/s speed of light. That's 400ms from finite speed of light. Switches, routers and relays along the way will add to that."