diff --git a/NEWS.md b/NEWS.md index 6e1ee223..d008a2b0 100644 --- a/NEWS.md +++ b/NEWS.md @@ -1,3 +1,19 @@ +*2019.03.13* + +@thexpaw@birdsite: +``` +So why did I get that email anyway if I'm opted out of all email communication in the account settings? +Which part of the privacy policy allows you to share data with marketing crap like trustpilot? +``` + +https://twitter.com/thexpaw/status/1108424723233419264 + +*2019.03.12* + +```Cool new tool : Cloud Firewall``` + +https://framapiaf.org/@gkrishnaks/101727497214557035 + *2019.03.03* ``` diff --git a/PEOPLE.md b/PEOPLE.md index b47d677d..4d8a97e7 100644 --- a/PEOPLE.md +++ b/PEOPLE.md @@ -7,7 +7,7 @@ format: "[TITLE](https://full.link/blog.html)" by [Who](Link) Sort: - New article: top + Recent article: top Disqualify: - Cloudflared website @@ -23,10 +23,26 @@ Disqualify: "[Don’t Use Cloudflare Because You Impose This on People Who Least Want It](http://techrights.org/2019/02/17/the-cloudflare-trap/)" by [Dr. Roy Schestowitz](http://techrights.org/) +"[Cloudflare: The bad, the worse and the ugly?](http://webschauder.de/cloudflare-the-bad-the-worse-and-the-ugly/)" by [Alle Beiträge](http://webschauder.de/author/jw/) + +"[I don’t trust Cloudflare with IPFS](https://blog.kareldonk.com/i-dont-trust-cloudflare-with-ipfs/)" by [Karel Donk](https://blog.kareldonk.com/) + +"[Cloudflare IPFS experiment](https://js.ipfs.io/ipns/QmZJBQBXX98AuTcoR1HBGdbe5Gph74ZBWSgNemBcqPNv1W/cloudflare-IPFS-experiment.html)" by [Joe](https://js.ipfs.io/ipns/QmZJBQBXX98AuTcoR1HBGdbe5Gph74ZBWSgNemBcqPNv1W/index.html) - ([archive](http://archive.fo/139z1)) + "[Don't Trust CloudFlare](https://write.lain.haus/thufie/dont-trust-cloudflare)" by [@lunaterra@cyberia.social](https://cyberia.social/@lunaterra) "[Stay away from CloudFlare](http://www.unixsheikh.com/articles/stay-away-from-cloudflare.html)" by [Unix Sheikh](http://www.unixsheikh.com/) +"[Support End-to-End Encryption on the Web](https://www.wordfence.com/blog/2017/03/support-end-to-end-encryption/)" by [Mark Maunder](https://www.wordfence.com/) + +"[Journal CloudFlare au milieu](https://linuxfr.org/users/thibg/journaux/cloudflare-au-milieu)" by [ThibG](https://linuxfr.org/) + +"[why you shouldn’t use Cloudflare](https://tech.tiq.cc/2016/01/why-you-shouldnt-use-cloudflare/)" by [tiq](https://tech.tiq.cc/) + +"[The CloudFlare MITM](https://web.archive.org/web/20160311163431/https://blog.paymium.com/2014/02/19/the-cloudflare-mitm/)" by [David FRANCOIS](https://blog.paymium.com/) + +"[Allergique à Cloudflare ? Voici comment vous soigner…](https://korben.info/cloudflare-mitm.html)" by [KORBEN](https://korben.info/) + "[CloudFlare, We Have A Problem](http://cryto.net/~joepie91/blog/2016/07/14/cloudflare-we-have-a-problem/)" by [joepie91](http://cryto.net/~joepie91/) "[On Cloudflare](https://www.tyil.nl/post/2017/12/17/on-cloudflare/)" by [tyil](https://www.tyil.nl/) @@ -45,4 +61,8 @@ Disqualify: "[Ditch Cloudflare - Broken HTTPS/MiTM](https://greysec.net/showthread.php?tid=1256)" by [NO-OP](https://greysec.net/member.php?action=profile&uid=47) +"[Cloudflare as a Security Risk - Support - Whonix Forum](http://forums.whonix.org/t/cloudflare-as-a-security-risk/2162)" by [entr0py](https://forums.whonix.org/u/entr0py) + "[How likely is it that CloudFlare is an NSA operation?](https://www.quora.com/How-likely-is-it-that-CloudFlare-is-an-NSA-operation/answer/Hamid-Sarfraz)" by quora + +"[cloudflare 是如何转发 HTTPS 流量的？](https://www.v2ex.com/t/406759)" by [feast](https://www.v2ex.com/member/feast) diff --git a/README.md b/README.md index 2192e7fe..48acb0f0 100644 --- a/README.md +++ b/README.md @@ -16,19 +16,31 @@ And their DNS service, [1.1.1.1](https://1.1.1.1/), is also filtering out users ![](image/dnscensor.jpg) +And here you might think, "_I am not using Tor or VPN, why should I care?_". +If you visit website which use Cloudflare, you are sharing your information not only to website owner _but also Cloudflare_. +It is impossible to analyze without [decrypting TLS traffic](https://github.com/nym-zone/block_cloudflare_mitm_fx/issues/15#issuecomment-354773389). Cloudflare knows all your data such as raw password. +[Cloudbeed](https://en.wikipedia.org/wiki/Cloudbleed) can happen anytime. +Do you really want to share your data with Cloudflare, and also 3-letter agency? + +![](image/dhssaid.jpg) + + + + +--- This repository is a list of websites that are behind The Great Cloudwall, and also actively blocking Tor users. -List +Domain list * [Domains using Cloudflare](split/) * [Non-Cloudflare but filtering/blocking Tor users](not_cloudflare/) Information -* [Padlock icon indicates a secure SSL connection established w MitM-ed](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831835) -* [Block Global Active Adversary Cloudflare](https://trac.torproject.org/projects/tor/ticket/24351) -* [Problem with CloudFlare](https://github.com/privacytoolsIO/privacytools.io/issues/374#issuecomment-460077544) - +* [Padlock icon indicates a secure SSL connection established w MitM-ed](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831835) by Anonymous +* [Block Global Active Adversary Cloudflare](https://trac.torproject.org/projects/tor/ticket/24351) by nym-zone +* [Problem with CloudFlare](https://github.com/privacytoolsIO/privacytools.io/issues/374#issuecomment-460077544) by libBletchley +* [Criticism and controversies](https://en.wikipedia.org/wiki/Cloudflare#Criticism_and_controversies) by Wikipedia There are more details of why what they are doing is wrong available [here](cloudflare-philosophy.md). Also see [Frequently Asked Questions](faq.md). @@ -44,7 +56,7 @@ Also see [Frequently Asked Questions](faq.md). * Add WTF-Cloudflare news to [NEWS.md](NEWS.md) * Search something on [Searxes Tor](http://searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion/) or [clearnet](https://searxes.danwin1210.me/) (this will help collecting Searxes' "MITM domains") * Take a look at [add-on code](ismitmlink/) (how to use "MITM test API") -* Subscribe to an ![](image/feed.png) RSS feed: "[The Great Cloudwall News](https://searxes.danwin1210.me/collab/open/getrss.php?q=tmg1news)" or follow ![](image/mstdn.jpg) [crimeflare@ieji.de](https://ieji.de/@crimeflare) +* Subscribe to ![](image/feed.png) RSS feed: "[The Great Cloudwall News](https://ieji.de/users/crimeflare.rss)" or follow ![](image/mstdn.jpg) [crimeflare@ieji.de](https://ieji.de/@crimeflare) ![WTF](image/wtfcf.jpg) diff --git a/cloudflare_owned_NS.txt b/cloudflare_owned_NS.txt index 64a3d27c..152aeefa 100644 --- a/cloudflare_owned_NS.txt +++ b/cloudflare_owned_NS.txt @@ -1,62 +1,101 @@ abby.ns.cloudflare.com adrian.ns.cloudflare.com +aida.ns.cloudflare.com +alan.ns.cloudflare.com albert.ns.cloudflare.com alex.ns.cloudflare.com +alina.ns.cloudflare.com alla.ns.cloudflare.com +amanda.ns.cloudflare.com amber.ns.cloudflare.com amy.ns.cloudflare.com andy.ns.cloudflare.com anna.ns.cloudflare.com +apollo.ns.cloudflare.com +arch.ns.cloudflare.com +aria.ns.cloudflare.com art.ns.cloudflare.com +asa.ns.cloudflare.com athena.ns.cloudflare.com austin.ns.cloudflare.com -ben.ns.cloudflare.com bella.ns.cloudflare.com +ben.ns.cloudflare.com +beth.ns.cloudflare.com bob.ns.cloudflare.com +brit.ns.cloudflare.com chan.ns.cloudflare.com +coby.ns.cloudflare.com coco.ns.cloudflare.com cody.ns.cloudflare.com +cory.ns.cloudflare.com darwin.ns.cloudflare.com dee.ns.cloudflare.com -dom.ns.cloudflare.com +demi.ns.cloudflare.com dina.ns.cloudflare.com +dom.ns.cloudflare.com +dora.ns.cloudflare.com +dorthy.ns.cloudflare.com drew.ns.cloudflare.com +duke.ns.cloudflare.com ed.ns.cloudflare.com +edna.ns.cloudflare.com elinore.ns.cloudflare.com +elmo.ns.cloudflare.com emma.ns.cloudflare.com +etta.ns.cloudflare.com +fay.ns.cloudflare.com foo.ns.cloudflare.com fred.ns.cloudflare.com +gabe.ns.cloudflare.com gail.ns.cloudflare.com glen.ns.cloudflare.com guy.ns.cloudflare.com +hank.ns.cloudflare.com +heather.ns.cloudflare.com hugh.ns.cloudflare.com ian.ns.cloudflare.com igor.ns.cloudflare.com +iris.ns.cloudflare.com +jasmine.ns.cloudflare.com jeff.ns.cloudflare.com jerry.ns.cloudflare.com jill.ns.cloudflare.com jim.ns.cloudflare.com +john.ns.cloudflare.com +jonah.ns.cloudflare.com josh.ns.cloudflare.com kate.ns.cloudflare.com +kevin.ns.cloudflare.com +kim.ns.cloudflare.com kip.ns.cloudflare.com leah.ns.cloudflare.com lee.ns.cloudflare.com leia.ns.cloudflare.com lex.ns.cloudflare.com +lily.ns.cloudflare.com +lucy.ns.cloudflare.com matt.ns.cloudflare.com +max.ns.cloudflare.com +megan.ns.cloudflare.com melinda.ns.cloudflare.com +miki.ns.cloudflare.com +nelly.ns.cloudflare.com newt.ns.cloudflare.com nina.ns.cloudflare.com norm.ns.cloudflare.com +norman.ns.cloudflare.com +olga.ns.cloudflare.com pam.ns.cloudflare.com paul.ns.cloudflare.com pete.ns.cloudflare.com +peyton.ns.cloudflare.com rachel.ns.cloudflare.com rick.ns.cloudflare.com rob.ns.cloudflare.com rose.ns.cloudflare.com seth.ns.cloudflare.com sofia.ns.cloudflare.com +tegan.ns.cloudflare.com terin.ns.cloudflare.com theo.ns.cloudflare.com zoe.ns.cloudflare.com \ No newline at end of file diff --git a/cloudflare_owned_domains.txt b/cloudflare_owned_domains.txt index 1dc13f45..4c739a62 100644 --- a/cloudflare_owned_domains.txt +++ b/cloudflare_owned_domains.txt @@ -6,6 +6,7 @@ cloudflare-quic.com cloudflare.com cloudflare.com.ve cloudflare.net +workers.dev cloudflareapi.com cloudflareapps.com cloudflarechallenge.com diff --git a/image/dhssaid.jpg b/image/dhssaid.jpg new file mode 100644 index 00000000..b8d51f84 Binary files /dev/null and b/image/dhssaid.jpg differ diff --git a/image/matthew_prince.jpg b/image/matthew_prince.jpg index 5bd8e3c2..0e463e19 100644 Binary files a/image/matthew_prince.jpg and b/image/matthew_prince.jpg differ diff --git a/instructions.md b/instructions.md index c2461c21..d9b6a013 100644 --- a/instructions.md +++ b/instructions.md @@ -72,7 +72,9 @@ IMPORTANT: Please add only "Base Domain" | -------- | -------- | | list_error403.txt | Returns HTTP Error 403 (Forbidden) | | list_customerror.txt | Returns custom error message (not HTTP 403) | -| list_other.txt | (not necessary?) | +| list_other.txt | any other form of tor-hostility or mistreatment | +| list_siteground.txt | siteground.com is a Tor-hostile hosting service that indiscriminately DoSes all Tor users with the collective judgement: "our system thinks you might be a robot!" Sometimes the site functions, and sometimes it times out, but the robot accusation is very common. | +| list_formerly_tor-hostile.txt | was previously on one of the above tor-hostile lists | ``` IMPORTANT: Please add only "Base Domain" or "(base domain)[space](comment here)" @@ -93,4 +95,4 @@ Add them to [/not_cloudflare/](not_cloudflare/) (formerly "*TorBlocker Hall of S This is a collection of websites that ban Tor exits, other than through Cloudflare(e.g. showing access denied pages, systematic timing out connections, ...). -[This add-ons](https://addons.mozilla.org/en-US/firefox/addon/which-website-rejected-me/) will help your list_error403 collection. \ No newline at end of file +[This add-ons](https://addons.mozilla.org/en-US/firefox/addon/which-website-rejected-me/) will help your list_error403 collection. diff --git a/ismitmlink/bg.js b/ismitmlink/bg.js index 5e575692..6a2a9393 100644 --- a/ismitmlink/bg.js +++ b/ismitmlink/bg.js @@ -1,7 +1,16 @@ -const apiurl = 'https://searxes.danwin1210.me/collab/open/ismitm.php'; -let mymemory = {}; +let apiurl = 'https://searxes.danwin1210.me/collab/open/ismitm.php'; +let TORapiurl = 'http://searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion/collab/open/ismitm.php'; -function ismitm(f) { +fetch('http://searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion/collab/open/hi.php', { + method: 'GET', + mode: 'cors' +}).then(r => r.text()).then(r => { + if (r == 'hi') { + apiurl = TORapiurl; + } +}).catch(() => {}); + +function is_infected(f) { return new Promise((g, b) => { fetch(apiurl, { method: 'POST', @@ -10,9 +19,7 @@ function ismitm(f) { 'Content-Type': 'application/x-www-form-urlencoded' }, body: 'f=' + f - }).then(function (r) { - return r.json(); - }).then(function (r) { + }).then(r => r.json()).then(r => { if (r[0]) { g(r[1]); } else { @@ -22,29 +29,49 @@ function ismitm(f) { }); } -browser.runtime.onMessage.addListener((request, sender, sendResponse) => { - if (request && sender) { - if (mymemory[request] != undefined) { - let rlt = mymemory[request]; - if (Object.keys(mymemory).length > 20000) { - let cnt = 1; - for (let t in mymemory) { - if (cnt > 10) { - break; - } - mymemory[t] = null; - delete mymemory[t]; - cnt++; - } - } - browser.tabs.sendMessage(sender.tab.id, [request, rlt]); - } else { - ismitm(request).then(function (a) { - mymemory[request] = a; - browser.tabs.sendMessage(sender.tab.id, [request, a]); - }, function () { - browser.tabs.sendMessage(sender.tab.id, [request, false]); - }); - } +function i_already_know_you(f) { + if (!/^([a-z0-9_.-]{1,255})\.([a-z]{2,80})$/.test(f)) { + return false; } -}); \ No newline at end of file + return new Promise((g, b) => { + browser.storage.local.get(f).then((ff) => { + if (ff[f]) { + if (ff[f] == 'y') { + g(1); + } else { + g(-1); + } + } else { + g(0); + } + }, () => { + g(0); + }); + }); +} + +function i_remember_you(f, t) { + browser.storage.local.set({ + [f]: ((t) ? 'y' : 'n') + }); +} + +browser.storage.local.clear().then(() => { + browser.runtime.onMessage.addListener((request, sender, sendResponse) => { + if (request && sender) { + i_already_know_you(request).then((r) => { + if (r == 1 || r == -1) { + browser.tabs.sendMessage(sender.tab.id, [request, ((r == 1) ? true : false)]); + } + if (r == 0) { + is_infected(request).then((a) => { + i_remember_you(request, a); + browser.tabs.sendMessage(sender.tab.id, [request, a]); + }, () => { + browser.tabs.sendMessage(sender.tab.id, [request, false]); + }); + } + }, () => {}); + } + }); +}, () => {}); \ No newline at end of file diff --git a/ismitmlink/cs.js b/ismitmlink/cs.js index b28b81ef..1361a666 100644 --- a/ismitmlink/cs.js +++ b/ismitmlink/cs.js @@ -1,32 +1,32 @@ -if (document.body) { - if (!['searxes.danwin1210.me', 'searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion', 'searxes.cyb'].includes(location.hostname)) { - let cs = (function () { - let s = document.createElement('style'); - document.head.appendChild(s); - return s.sheet; - })(); - if (cs) { - cs.insertRule("a[data-mitm]{text-decoration-line:line-through !important;text-decoration-color:red !important;text-decoration-style:double !important}", 0); - cs.insertRule("a[data-mitm]::after{content:'[MITM!]';font-weight:bold}", 1); - } - let asked = [location.hostname, 'searxes.danwin1210.me', 'searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion', 'searxes.cyb']; - document.querySelectorAll("a[href^='http://']:not([data-mitm]),a[href^='https://']:not([data-mitm]),a[href^='//']:not([data-mitm])").forEach(a => { - let aF = (new URL(a.href)).hostname; - if (!/^(.*)\.(onion|i2p|invalid|test|local|localhost|([0-9]{1,3}))$/.test(aF) && !asked.includes(aF)) { - asked.push(aF); - browser.runtime.sendMessage(aF); - } - }); - browser.runtime.onMessage.addListener((request, sender, sendResponse) => { - if (request.length == 2) { - if (request[1]) { - document.querySelectorAll("a[href^='http://" + request[0] + "/']:not([data-mitm]),a[href^='https://" + request[0] + "/']:not([data-mitm]),a[href^='//" + request[0] + "/']:not([data-mitm])").forEach(a => { - a.dataset.mitm = 1; - a.title = 'MITM!'; - }); - } - } - sendResponse(null); - }); +if (document.body && !['searxes.danwin1210.me', 'searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion', 'searxes.cyb'].includes(location.hostname)) { + let cs = (function () { + let s = document.createElement('style'); + document.head.appendChild(s); + return s.sheet; + })(); + if (cs) { + cs.insertRule("a[data-mitm]{text-decoration-line:line-through !important;text-decoration-color:red !important;text-decoration-style:double !important}", 0); + cs.insertRule("a[data-mitm]::before{content:'[MITM!]';font-weight:bold !important;color:red !important}", 1); + cs.insertRule("a[data-mitm]:hover::before{content:'[Privacy Risk!!]'}", 2); + cs.insertRule("a[data-mitm]:hover{color:red !important}", 3); } + let asked = ['searxes.danwin1210.me', 'searxes.nmqnkngye4ct7bgss4bmv5ca3wpa55yugvxen5kz2bbq67lwy6ps54yd.onion', 'searxes.cyb', 'addons.mozilla.org']; + document.querySelectorAll("a[href^='http://']:not([data-mitm]),a[href^='https://']:not([data-mitm]),a[href^='//']:not([data-mitm])").forEach(a => { + let aF = (new URL(a.href)).hostname; + if (!/^(.*)\.(onion|i2p|invalid|test|local|localhost|([0-9]{1,3})|bbs|chan|cyb|dyn|geek|gopher|indy|libre|neo|null|o|oss|oz|parody|pirate|bit|lib|coin|emc|bazar|fur)$/.test(aF) && !asked.includes(aF)) { + asked.push(aF); + browser.runtime.sendMessage(aF); + } + }); + browser.runtime.onMessage.addListener((request, sender, sendResponse) => { + if (request.length == 2) { + if (request[1]) { + document.querySelectorAll("a[href^='http://" + request[0] + "/']:not([data-mitm]),a[href^='https://" + request[0] + "/']:not([data-mitm]),a[href^='//" + request[0] + "/']:not([data-mitm])").forEach(a => { + a.dataset.mitm = 1; + a.title = 'DANGER! DANGER! MITM!'; + }); + } + } + sendResponse(null); + }); } \ No newline at end of file diff --git a/ismitmlink/manifest.json b/ismitmlink/manifest.json index 885e2004..f064778d 100644 --- a/ismitmlink/manifest.json +++ b/ismitmlink/manifest.json @@ -2,9 +2,13 @@ "manifest_version": 2, "name": "Are links vulnerable to MITM attack?", "description": "Scan FQDN using Searxes' API", - "version": "1.0.2", + "version": "1.0.4", + "homepage_url": "https://notabug.org/themusicgod1/cloudflare-tor/src/master/ismitmlink", "author": "Maslin Bossé", - "permissions": [], + "permissions": [ + "storage", + "unlimitedStorage" + ], "icons": { "32": "icons/32.png" }, diff --git a/not_cloudflare/README.md b/not_cloudflare/README.md index 24e938db..6fe2d14f 100644 --- a/not_cloudflare/README.md +++ b/not_cloudflare/README.md @@ -1,4 +1,5 @@ # Which websites are hostile to Tor users? +Don't block us! -Don't block us! \ No newline at end of file +See [instructions.md](file://../instructions.md) for file purpose and format specifications. diff --git a/not_cloudflare/get_fqdn_tmg1.php b/not_cloudflare/get_fqdn_tmg1.php new file mode 100644 index 00000000..04e65b57 --- /dev/null +++ b/not_cloudflare/get_fqdn_tmg1.php @@ -0,0 +1,23 @@ + **How?** +> 1. Download [Tor](https://www.torproject.org/) and install it on your computer. +> 2. Add this line to "torrc" file. [DNSPort description](https://www.torproject.org/docs/tor-manual.html.en). +> DNSPort 127.0.0.1:53 +> 3. Restart Tor. +> 4. Set your computer's DNS server to "127.0.0.1". - Tell us if you see [this functionality](https://ungleich.ch/en-us/cms/blog/2018/08/04/mozillas-new-dns-resolution-is-dangerous/) start to creep up beyond Firefox Nightly into more stable versions of Firefox. @@ -190,6 +214,8 @@ Let's talk about _other software's privacy_... - Let us know of any alternatives to help at least provide multiple layered defence against Cloudflare. +- If you are a Cloudflare customer, set your privacy settings, and wait for them to violate them. Then bring them under [anti-spam / privacy violation charges](https://twitter.com/thexpaw/status/1108424723233419264). + - Try using [globalist](globalist.txt) to maintain this list. - If you are in the **United States of America** and the website in question is a bank or an accountant, try to bring legal pressure under the [Gramm–Leach–Bliley Act](https://en.wikipedia.org/wiki/Gramm%E2%80%93Leach%E2%80%93Bliley_Act), or the [Americans with DIsabilities Act](https://www.ada.gov/cguide.htm) and report back to us how far you get.