CloudFlare is an endpoint for predictable actions; and serves overseas websites. So, even a state that doesn't necessarily have power to infiltrate a foreign ho

CloudFlare is an endpoint for predictable actions; and serves overseas websites. So, even a state that doesn't necessarily have power to infiltrate a foreign host might still be able to identify users of those foreign hosts. So, say I use Tor to make political comments on a foreign website; one that I have reasonable trust is outside the reach of my government. But, say that website uses CloudFlare and CloudFlare has servers that are within reach of my government. That's the difference. It is a difference of degree, rather than kind, but a difference nonetheless. Powerful actors have always had some ability to compromise Tor by compromising the requesting side (the ISP of the target of an investigation, for example), and then the receiving side (the website where your suspect does the thing you're investigating them for...possibly a honey pot setup specifically to catch people who do this thing, or possibly a website whose owner has already been arrested, prosecuted and made a deal that allowed access to the systems). CloudFlare just adds an additional element of uncertainty for Tor users: Will this CAPTCHA take place in a way and place that allows someone to narrow down my identity? As with a lot of the security concerns about Tor, one has to take it as weights on a scale. Who are my attackers, and what level of attack can they bring against my traffic? If your privacy concerns don't include state level actors, then this is probably a theoretical attack. If your attackers do include state level actors, then it is a concern to be aware of. State level actors have other means of compromising your identity and traffic, of course, but this is one of them, and if I understand it correctly, it is a valid concern.