Introducing the Cloudflare Onion Service

> Tor isn’t known for being fast.

Boy, is Tor fast. Try i2p if you would love to see what “not known for being fast” means. Tor is reasonably fast for its use-cases, and those are - for most part - not watching videos.

That said, I very much applaud Cloudflare working on this! The Cloudflare-wall-of-death for Tor users always makes me navigate away from pages immediately.

It enhances privacy by removing the exit nodes and the transit across the Internet. It should make browsing Cloudflare managed sites via Tor fast. It makes it easier for us to deal with abusive requests from the Tor network because we can terminate individual circuits that are abusive and leave legit users alone. It fulfils a promise we made a long time ago. It's cool.

Thanks to CloudFlare for working with Tor on these issues. The browsing experience for us legit Tor users is much better than it used to be.

I hope that eventually, .onion services can get DV certs so their proxy can serve that cert if the user connects directly, bypassing the need to connect through an exit node for the first connection.

One thing I'm curious about:

> While bad actors can still establish a fresh circuit by repeating the rendezvous protocol, doing so involves a cryptographic key exchange that costs time and computation.

Is there some way for the destination .onion service to scale the difficulty of this rendezvous challenge, so this proof-of-work scheme can continue to work? It would be sad if they get to the point where it's no longer an effective rate limit and have to go back to serving CAPTCHAs for every new circuit.

Good to hear.

For what it's worth, I haven't seen a CAPTCHA browsing cloudflare sites for a long time (months?), until just today I've gotten two (out of several tens of CF-backed sites visited). Could be related to these changes, not sure.

> The option is available in the Crypto tab of the Cloudflare dashboard.

I'm not currently seeing this in my account.