Topic: [Feature] Disable registrations from Tor addresses (Bonus: blocks spam bots as well)

Posted under Site Bug Reports & Feature Requests

Requested feature overview description.
Tor, while a great thing, is often used by baddies, someone recently(whom will not be named) got banned for using Tor to ban evade. Most of the time, Tor will most likely be used to ban evade on e621. Other times it is used by people in countries like Russia which block e621.(This can be remedied by making a read only e621 onion page, but entirely optional)

Example implementation I wrote for this

#!/usr/bin/env ruby
require 'net/http'
require 'json' #Probably already included in the codebase
 
 
#If you want, you can also check common spam emails by using
#http://api.stopforumspam.org/api?ip=%s&email=%s&f=json
url = URI.parse(
    format(
        'http://api.stopforumspam.org/api?ip=%s&f=json',
        request.remote_ip #This may need to be changed due to cloudflare
    )
)
req = Net::HTTP::Get.new(url.to_s)
res = Net::HTTP.start(url.host, url.port) {|http|
  http.request(req)
}
 
if res.code != "200"
    p "Uh oh, an error occurred during registration!"
else
    sfs = JSON.parse(res.body)
    if sfs["success"] == 1
        if sfs["ip"]["appears"] == 0
            #They should be safe, let them enter
            p "Welcome!"
        else
            if sfs["ip"].has_key?("torexit") and sfs["ip"]["torexit"] == 1
                #Tor exit node, probably ban evader
                p "Registration for tor exit nodes are disabled. " \
                  "If you believe this is a mistake, please contact " \
                  "[email protected]"
            elsif sfs["ip"]["confidence"] > 5
                #Probably shouldn't be here, AKA: spam bot
                p "Registration from this address is disabled due to" \
                  " high confidence rating on " \
                  "http://stopforumspam.org/. If you believe this is " \
                  "a mistake, please contact [email protected]"
            end
        end
    else
        #Throw up an internal error, probably bad IP passed to field
        p "Internal error!"
    end
end

Full documentation can be read here http://www.stopforumspam.com/usage
As for worries about it locking off registrations due to outage, stopforumspam is used by a TON of websites, they keep their servers up.

Why would it be useful?
Prevent ban evaders(And also spambots, which is a bonus).

What part(s) of the site page(s) are affected?

  • Registration

Updated by Ratte

How about the users in countries like Russia, where e621 is blocked by the government, who use Tor for legitimate purposes?

SFS is good, I've used it in a few forums before. Does e6 really get any issues from spam bots though? They'd usually just target the popular forum software

EDIT: didn't actually notice your part about Russia you'd already wrote, but I still believe that allowing Tor registrations is more good than bad.

Updated by anonymous

Chaser said:
Requested feature overview description.
Tor, while a great thing, is often used by baddies, someone recently(whom will not be named) got banned for using Tor to ban evade. Most of the time, Tor will most likely be used to ban evade on e621. Other times it is used by people in countries like Russia which block e621.(This can be remedied by making a read only e621 onion page, but entirely optional)

Example implementation I wrote for this

#!/usr/bin/env ruby
require 'net/http'
require 'json' #Probably already included in the codebase
 
 
#If you want, you can also check common spam emails by using
#http://api.stopforumspam.org/api?ip=%s&email=%s&f=json
url = URI.parse(
    format(
        'http://api.stopforumspam.org/api?ip=%s&f=json',
        request.remote_ip #This may need to be changed due to cloudflare
    )
)
req = Net::HTTP::Get.new(url.to_s)
res = Net::HTTP.start(url.host, url.port) {|http|
  http.request(req)
}
 
if res.code != "200"
    p "Uh oh, an error occurred during registration!"
else
    sfs = JSON.parse(res.body)
    if sfs["success"] == 1
        if sfs["ip"]["appears"] == 0
            #They should be safe, let them enter
            p "Welcome!"
        else
            if sfs["ip"].has_key?("torexit") and sfs["ip"]["torexit"] == 1
                #Tor exit node, probably ban evader
                p "Registration for tor exit nodes are disabled. " \
                  "If you believe this is a mistake, please contact " \
                  "[email protected]"
            elsif sfs["ip"]["confidence"] > 5
                #Probably shouldn't be here, AKA: spam bot
                p "Registration from this address is disabled due to" \
                  " high confidence rating on " \
                  "http://stopforumspam.org/. If you believe this is " \
                  "a mistake, please contact [email protected]"
            end
        end
    else
        #Throw up an internal error, probably bad IP passed to field
        p "Internal error!"
    end
end

Full documentation can be read here http://www.stopforumspam.com/usage
As for worries about it locking off registrations due to outage, stopforumspam is used by a TON of websites, they keep their servers up.

Why would it be useful?
Prevent ban evaders(And also spambots, which is a bonus).

What part(s) of the site page(s) are affected?

  • Registration

I think this is a bad idea, for two reasons.

The first is that this kind of policy punishes large swaths of people because some of them might potentially do something bad, and doesn't focus on the people who actually do the bad thing in question. These policies hurt far more people than they help.

The second reason is that it doesn't really solve the problem. A ban evader can just as easily use a VPN or a proxy to accomplish exactly the same thing.

Updated by anonymous

Tuvalu said:
How about the users in countries like Russia, where e621 is blocked by the government, who use Tor for legitimate purposes?

SFS is good, I've used it in a few forums before. Does e6 really get any issues from spam bots though? They'd usually just target the popular forum software

EDIT: didn't actually notice your part about Russia you'd already wrote, but I still believe that allowing Tor registrations is more good than bad.

InannaEloah said:
I think this is a bad idea, for two reasons.

The first is that this kind of policy punishes large swaths of people because some of them might potentially do something bad, and doesn't focus on the people who actually do the bad thing in question. These policies hurt far more people than they help.

The second reason is that it doesn't really solve the problem. A ban evader can just as easily use a VPN or a proxy to accomplish exactly the same thing.

If I read the suggestion correctly, this would ONLY be for registering new accounts. That means those wanting to access site where it's blocked, etc. would still be able to do this without any issues. It's just registering that will be disabled and if you are using something like tor to browse here, changes are you do not want to interact here, just browse.

Also if there are legimitate users who want to register but only have tor, isn't there a way for admins/moderators to create an account manually for users? In this case, those users could just email or irc about creating account and I'm fairly sure that the amount of work that creates might be countable with single hand.

Of course staff is more aware of how big precentage it actually is from tor users who are using it for bad and how much are legimitate ones.

Updated by anonymous

I don't see any reason to do this unless admins actually report having too much trouble with Tor nodes.

Updated by anonymous

Ratte

Former Staff

Lance_Armstrong said:
I don't see any reason to do this unless admins actually report having too much trouble with Tor nodes.

I have. Many times.

Updated by anonymous

  • 1