Google and Tor.

[Mike Perry]

Thus spake Aplin, Justin M (jmaplin at ufl.edu):

> On 8/25/2010 8:52 PM, Mike Perry wrote:
> >Thus spake Matthew (pumpkin at cotse.net):
> >
> >   
> >>  On numerous occasions when using Google with Tor (yes, I know there are
> >>other options like Scroogle) it claims I might be sending automated 
> >>queries
> >>and gives me a CAPTCHA.  Sometimes this allows me to search; other times I
> >>am caught in a loop and am constantly send back to the CAPTCHA screen.
> >>     
> >This has been a known problem with Google for ages.
> >   
> (snip)
> 
> Really? I've never had this problem until recently. For about 2 years 
> now every Google CAPTCHA I've run into has been uneventful and let me 
> through after the first try, only in the past month or so have I been 
> getting caught in the "CAPTCHA loop".

Various horrible behaviors have come and go with this captcha system
over the past 3 years or so. Sometimes you just get a 403 with no
captcha, sometimes you have to solve a captcha, sometimes 2 captchas,
sometimes infinite captchas, and sometimes it forgets your query and
you have to start the whole process over again from a Google landing
page.

My point is that the whole system is problematic on a number of
levels. I also personally believe that there are better ways of rate
limiting and screening queries from high-user count IPs that do not
involve cookies or captchas.

I also question Google's threat model on this feature. Sure, they want
to stop people from programmatically re-selling Google results without
an API key in general, but there is A) no way people will be reselling
Tor-level latency results, B) no way they can really expect determined
competitors not to do competitive analysis of results using private IP
ranges large enough to avoid DoS detection, C) no way that the total
computational cost of the queries coming from Tor can justify denying
so many users easy access to their site.

This is why I'd love a chance to meet with the DoS team to discuss
some of these points. However, I get the strong impression it is a
very secretive group that is especially wary of discussing their
methods, reasoning, or analysis and with anyone else, and is generally
given a blank check to enact policy without proper in-depth
cost/benefit analsysis because its actions are "for security".


-- 
Mike Perry
Mad Computer Scientist
fscked.org evil labs
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20100825/175e5d3a/attachment.pgp>