Very true. If you're running a business that accepts credit cards then it's completely negligent to not block TOR traffic. A lot of credit card fraud comes from people using TOR if you leave that open.

It's arguably negligent to not block TOR traffic from your payment page. People should otherwise be able to read at least the static parts of your site from TOR.

I partially disagree.

"TOR traffic" is as undesirable as regular traffic, no more no less. From first-world perspective, this maybe skewed towards TOR, but elsewhere TOR is used as everyday, lifeline resource.

From data volume perspective, maybe you are correct. From number of users perspective, I do not believe so.

>If you're running a business that accepts credit cards then it's completely negligent to not block TOR traffic.

Blocking a set of known bad exit relays should be blocked. TOR in general, no.

Lots of businesses taking payments online get the overwhelming majority of their sales from visitors with a "first-world perspective". It can make complete sense to blanket-ban TOR and other signs of bad actors at a cost of 0.1% of your sales (not an unlikely figure).

I like the idea of an open free-for-all Web, too, but I don't expect businesses to stop doing this, given the incentives in play.

It seems reasonable to show a captcha to tor traffic, given the current state of it.