Introducing the Cloudflare Onion Service

I'm not sure if you remember a month or so ago, a HN commenter mentioned how infuriating the experience of browsing Cloudflare sites on Tor is, because he get's the "Not a Robot" captcha every-single-time, I assume this also helps improve the experience for Tor users to show as a legit user when browsing other Cloudflare sites, so all in all the traffic looks clean.

This is a good feature. Still, appears you are hitting Cloudflare first via an exit. I would say if whatever service you are using has its own onion, use that instead. I assume the way Cloudflare is determining if I am using Tor is by doing an IP lookup match w/ known exits? I would expect this feature would reduce bandwidth on the exit nodes which is great for decentralization. However, if you weren't to trust Cloudflare, this could be bad as its now opening up a central company to route traffic for Cloudflare customers, making it a central location for traffic analysis attacks (again, if you don't trust Cloudflare). At least exit nodes are a bit more distributed (but not much as there are still a very limited number, and you have to trust them too).

Also, since OnionBalance doesn't support v3 services yet, what is Cloudflare using behind those onion services to make them HA? Or are they each running on single machines acting as gateways that load balance after that?

Also, count me as one of those people that don't see much value DV certs have for onion services. A v3 onion is itself proof you have the ed25519 private key, so DV adds little on an identity and encryption front. EV has extra identity verification of course. I've read the EFF mailing list post in justification, and I'd say if features of TLS are a requirement (e.g. benefits of HTTPS), you might as well allow self-signed certs instead of having people use a CA. Granted, it's fairly harmless to allow DV for onion services, I just don't want to see it become the norm for HTTP-based onion services via promotion of the concept.

Shameless plug, here's a toolkit to create your own onion services easily in just a few lines: https://github.com/cretz/bine (including non-anonymous mode like the CF onion services). You can fire one up for your own site and give it as an HTTP alt svc.

IMHO, Nowadays' Cloudflare is like Google or Facebook from 10 years ago.

What Cloudflare is doing, is essentially centralize the entire Internet infrastructure from DNS, HTTPS to WWW, to the extend that Cloudflare can be the most powerful man-in-the-middle attacker if it wanted to be, can track whoever they wanted, or carry out random censorship, hence harmful to security and privacy in the long run. In fact, the Cloudbleed vulnerability (https://news.ycombinator.com/item?id=13766339) has already shown the enormous scale of damage that Cloudflare is capable of doing. For this reason, some of the most radical privacy advocates went to call Cloudflare the "active global adversary".

However, Cloudflare at this stage, still has a strong motivation that they should act as a supporter of a secure, free, open, and humane Internet, believing it is the principle of a company in the Silicon Valley, and especially when many of the beliefs currently are consistent with their business interests. So, currently, they think they should not abuse the power, but instead, should keep neutral and do the public good.

Freedom - This is the reason that Cloudflare does not aggressively banning websites solely based on a single DMCA complaint, in fact, Cloudflare used to host The Pirate Bay just fine (only stopping doing it after a formal legal ruling I believe). First, because they believe in free speech, don't want to perform extensive private censorship beyond the laws. And second, because adopting the principle of neutrality as a common carrier is the best strategy for their business interests - a ISP doesn't use their arbitrary judgements to censor objectionable content, for Cloudflare, the largest CDN hosting service online, needs to adhere the same principle, for both ideological and commercial reasons. Their censorship of Daily Stormer (https://www.eff.org/deeplinks/2018/01/private-censorship-not...) manifested the power they have, perhaps in the case it is good, but thinking about the severity of the consequence if abused, is horrible. Now, the CEO of Cloudflare agreed that he shouldn't have this level of private power, and promised he would not do something like this anymore, but...

Security and Privacy - This is why Cloudflare made crucial contributions to the development and mass adoption of HTTPS/TLS, making working solution and optimizations, etc, and setting up 1.1.1.1, the privacy-respecting DNS service that even available as a Tor online service, also recently opening up a IPFS gateway. They even developed a zero-knowledge proof system for user's privacy.

Back to the Tor issue, which is our main topic. While I said the some of the most radical privacy advocates went to call Cloudflare the "active global adversary", other people also have problems with Cloudflare, especially the IP-address based Web Application Firewall, which would inevitably discriminate Tor users, bombard them with an endless number of CAPTCHA. They got criticized by the Tor Project (https://blog.torproject.org/trouble-cloudflare). Cloudflare felt that they have their responsibility to support privacy, so they acknowledge the problem, and actively working towards solutions. Initial measures included allowing website owners to whitelist Tor users, reducing the frequency of the CAPTCHA for Tor users. Now, their Cloudflare Onion Service is obviously their complete, permanent solution to this problem, which allows strong end-to-end encryption, allows the traffic to stay in the Tor network, and also allows Cloudflare to distinguish different Tor sessions to block abusive ones. This solution is a win-win-win, for users, Tor Project, and Cloudflare. Because it allows strong encryption and eliminates the possibility of wiretapping on Exit node, it also greatly decreases the traffic pressure on Tor exit node (scarce resource), particularly when Cloudflare is the largest traffic destination, it also allows Cloudflare to continue doing its firewalling and security protections against malicious clients.

So people continue to welcome Cloudflare and celebrate their innovation, their achievement of user's security and privacy, social responsibility, diversity, human rights, etc... Just like Google or Facebook from 10 years ago.

Until one day, perhaps after a decade, when Cloudflare's influences grow larger and larger, when effective market competition ceased to exist, and when Cloudflare gained nearly total monopolistic power... Just like Google, it will slowly stop emphasize their ideals and values (maybe fewer real contributions like now, but more PRs), and more and more profit-focused, and eventually they will start abusing their powers...

to provide data they gather as the man-in-the-middle to the NSA, to comply with local government's requirements on data collection and to provide data to oppressive governments, to analytic firms, to perform private censorship for their own political or monetary interests, to block innovation and decentralization of the Internet using its role and social norm in the cyberspace (e.g. an hypothetical scenario can be - if you self-host, you will be a victim of endless online attacks, which has grown more and more serious in recent years, but since everyone uses Cloudflare, no one ever cares about it anymore...).

And just became yet another Google, yet another Evil Corp, and this is the end of the story...

Meanwhile, at this time, another college kid in a garage wants to start a business to disrupt the market, to make a revolutionary solution, or to end the monopoly, just like Apple, Google, or Cloudflare's original vision...

> I should investigate the alt-svc thingy and add a tor node on my services for that stuff... Very interesting.

If you do, I'd say also make the onion address known and just offer that up to your users too. If you're hosting your own onion and own site, the alt-svc thing only has value to those who can't remember the onion (and don't mind the extra lookup).

What other measures are in the works, since this is only part? I'm excited to see more widespread adoption of privacy technology. Thank you for listening to our complaints, genuinely happy to see progress on this front.