Alec Muffett

tl;dr - there are few exit nodes & they get used for some badness, but the legitimate usage over Tor is proportionate to the rest of the Net

Source:https://twitter.com/jschauma/status/715898230408671232 …

No, that's not what that charts says at all. That just shows that people use Tor for the same kind of attacks as non-Tor.

Tor is awesome, but denying it's being used for bad stuff more than non-Tor traffic isn't helpful at all to make it work better

(I'm not implying you're denying that, but there's a Pavlov response from many Tor users when someone points out the stats.)

I definitely agree re: the Pavlov response, have seen it "up close" so to speak. :-)

It's a tautology to say "Legitimate Tor Use Is Legitimate" but that's what I'm left with, and also the observation that:

…when N(legitUsersOverTor) is large, it's good to make some affordance for them. Because large number of legit users. :-)

Where can I get the full slide deck?

In other words, blocking Tor users from seeing your site is more than 98% ineffective as a security strategy. @AlecMuffett @matthew_d_green

@matthew_d_green I’m as willing as anyone to give Tor shit, but this is not how one stats

I'd expect this from network request aggregators like Tor exit nodes. Same number of bad actors compressed to fewer IPs.

A 1.24% malicious req rate much more in line with observed 0.4% pillz spam + sql inject rate @AlecMuffett @dotMudge cc @martijn_grooten

I don't see 1.24% in that slide.

I typoed a 4 for a 6. Of malicious requests, Tor nodes accounted for 1.26%