2
$\begingroup$

Overview:

I use TorBrowser daily, even when I'm accessing my stackexchange accounts. This hasn't ever been a problem, until recently (I think in the last few months).

The issue is that various features have begun to fail with errors:

  1. Comments on any posts fail to upload (even on my own)

CSE comment upload error message

  1. The overflow comments do not load

CSE comment overflow load error message

  1. My inbox is inaccessible

CSE inbox toolbar icon button error message

  1. And, the reputation changes button is also broken

CSE rep change toolbar icon button error message


As a TorBrowser user, I'm quite accustomed to websites using shadow UX patterns to get users like myself to use more tracking-friendly browsers. That is, through the lateral force of inconvenience. As a tech community, I'd hope stack would not abide by this kind activity. Much less, the members of the crypto & security exchanges. Perhaps there's another issue I've not considered. Here are the things I've tried to resolve the issue (without switching browsers).

  • Whitelisted all stack exchange sites in cookie settings
  • Disabled NoScript & AdBlockers
  • Disabled "always private browsing"
  • Set the lowest security settings (Standard)
  • Tried on various stack sites (crypto, security, overflow)
  • Tried on a vanilla extract of a new TorBrowser

If you have any suggestions for other ways I can try to resolve this issue on my end, I'd be happy to give them a try. If on the other hand this needs to get pushed up to staff / dev or product teams, I'd much appreciate the help in bumping this up to where it needs to go. These problems are really diminishing my ability to participate in the community.


Side-note:

Has something changed with how CloudFlare does its security checks for anomalous behavior? I've noticed "are you human" check-boxes which also seem to be malfunctioning. Perhaps it's related?

CSE CloudFlare security widget spinning wheel of doom

The above widget appeared after clicking the "Help" link next to the comment input box. It's come up before, where it appears to either perform a no-op, or redirects the current page to a blank page. All very strange, and very inconvenient.


Updates:

2023-10-12

I began to write a message directly to SE as suggested by the very helpful answer by Morrolan. After pressing "Submit" on the Help Center's Contact Us form, I received the following error

SE Contact Us Form Submission Failure Message

Which is quite consistent with the experience I'm having with SE. I can't even request help because of the discrimination against Tor traffic. This is absurd. I'm signed into my account & have a legitimate issue to report. Even in the best light, this pervasive blocking of Tor traffic amounts only to symbolic digital security. Bad actors will not be limited by such controls. They can utilize arbitrary compromised devices on the web to forward traffic, or even use commercial VPNs, and would be able to bypass all these harmful "safeguards". But, regular users who decide to use TorBrowser receive an unacceptable user experience. It's completely frustrating, and dangerous.

I leave the email I would have sent the help desk here for archival reference:

I'm having various usability issues with stackexchange & stackoverflow which I've documented in the following post on meta.

Is TorBrowser usage being shadow-banned?

In summary, key features of the sites are not functioning & fail with errors. Features such as commenting on posts, reading comments, accessing the inbox & reviewing reputation changes. I believe this is happening because the service provider https://www.cookielaw.org/, which is used by SE, is outright blocking requests from all Tor users, & I am a TorBrowser user.

The wider concern is that, with such a small change in CDN, & the code which they serve, SE can be made completely unusable for users who opt for privacy preserving technologies. This would be harmful for user privacy, take away critical choices in user digital self-defense, & can even be done unbeknownst to SE itself. I'm ringing the alarm bell because this is a potentially grave issue.

Please feel free to reach out if there's any way I can assist further with resolving this issue for the users of SE.

Regards,

$\endgroup$
1
  • 2
    $\begingroup$ When you get one of these "an error occurred" popups, check the JS console and network logs of your browser's dev tools. There will likely be either a JS exception or a failed HTTP request, which might provide some insight. (Nitpick: Shadow-banning would be about SE not showing your content to others. The behaviour you hint at would be more in the realm of "dark UX patterns" to incentivize users to switch browsers). $\endgroup$
    – Morrolan
    Oct 11, 2023 at 16:03

1 Answer 1

2
$\begingroup$

Having played with it a bit: One fundamental issue I encountered is that they use Optanon for their "do you consent to us storing cookies" implementation. Specifically pressing the "I accept" button will load all kinds of JS from cookielaw.org's CDN, such as https://cdn.cookielaw.org/scripttemplates/otSDKStub.js.

However, Optanon (both their website as well as their CDN) seem to outright block any requests originating from TOR exit nodes. Thus said JS fails to load. Likely much of StackExchange's own JS code will then later on fail when it wants to check whether it's allowed to store cookies, as the code it's trying to call is not present.

Then, it's not much of a surprise that the website won't work properly in all kinds of surprising ways. Assuming you observe the same behaviour, you could contact SE themselves, and inform them that Optanon's CDN seems to block requests from TOR.

A cursory search brought up a meta.SE post, where another user observed that cookielaw.org blocks requests originating from TOR. Another user supposedly fixed it by allowing those requests to bypass Tor.

$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .