4 ms·

This is a good feature. Still, appears you are hitting Cloudflare first via an exit. I would say if whatever service you are using has its own onion, use that i

This is a good feature. Still, appears you are hitting Cloudflare first via an exit. I would say if whatever service you are using has its own onion, use that instead. I assume the way Cloudflare is determining if I am using Tor is by doing an IP lookup match w/ known exits? I would expect this feature would reduce bandwidth on the exit nodes which is great for decentralization. However, if you weren't to trust Cloudflare, this could be bad as its now opening up a central company to route traffic for Cloudflare customers, making it a central location for traffic analysis attacks (again, if you don't trust Cloudflare). At least exit nodes are a bit more distributed (but not much as there are still a very limited number, and you have to trust them too). Also, since OnionBalance doesn't support v3 services yet, what is Cloudflare using behind those onion services to make them HA? Or are they each running on single machines acting as gateways that load balance after that? Also, count me as one of those people that don't see much value DV certs have for onion services. A v3 onion is itself proof you have the ed25519 private key, so DV adds little on an identity and encryption front. EV has extra identity verification of course. I've read the EFF mailing list post in justification, and I'd say if features of TLS are a requirement (e.g. benefits of HTTPS), you might as well allow self-signed certs instead of having people use a CA. Granted, it's fairly harmless to allow DV for onion services, I just don't want to see it become the norm for HTTP-based onion services via promotion of the concept. Shameless plug, here's a toolkit to create your own onion services easily in just a few lines: https://github.com/cretz/bine https://github.com/cretz/bine (including non-anonymous mode like the CF onion services). You can fire one up for your own site and give it as an HTTP alt svc.

jgrahamc 8y ago
Reading your comment I think you're a little confused about what this is. This is for Cloudflare customers. Before this you went across normal Tor and hit an exit node and then went across the Internet to connection the nearest Cloudflare PoP. After this you go to the onion being run by Cloudflare eliminating the exit node and the hop across the Internet. If you already have an onion for your service then you are already not using Cloudflare.
- kodablah 8y ago
  Nah, I get it and think it's good for Cloudflare customers over what happens today. My comment was a bit of scattershooting admittedly, so I can clarify this point. > If you already have an onion for your service then you are already not using Cloudflare. To clarify my point, what I mean is I might have "kodablahforum.com" running behind Cloudflare but I might, as a convenience for my users, offer my service behind an onion service unrelated to Cloudflare. I am saying, if the service offers that option, it can be seen as a bit more secure (if you don't mind the unwieldiness of the onion service address) to access that instead of the regular domain that hits Cloudflare via an exit and then routes all traffic through Cloudflare onion services. Again, in general, I agree this is a complete improvement for non-onion-service using Tor browser users of Cloudflare customer sites. And I think it's a good pattern for sites/hosts/CDNs to follow (i.e. onions as HTTP alt services) in the current absence of acceptably secure/decentralized DNS for onion services. But direct onion service access hosted by the endpoint is always preferred over a middleman if it is an option.

jgrahamc 8y ago

Reading your comment I think you're a little confused about what this is. This is for Cloudflare customers. Before this you went across normal Tor and hit an exit node and then went across the Internet to connection the nearest Cloudflare PoP. After this you go to the onion being run by Cloudflare eliminating the exit node and the hop across the Internet. If you already have an onion for your service then you are already not using Cloudflare.

kodablah 8y ago
Nah, I get it and think it's good for Cloudflare customers over what happens today. My comment was a bit of scattershooting admittedly, so I can clarify this point. > If you already have an onion for your service then you are already not using Cloudflare. To clarify my point, what I mean is I might have "kodablahforum.com" running behind Cloudflare but I might, as a convenience for my users, offer my service behind an onion service unrelated to Cloudflare. I am saying, if the service offers that option, it can be seen as a bit more secure (if you don't mind the unwieldiness of the onion service address) to access that instead of the regular domain that hits Cloudflare via an exit and then routes all traffic through Cloudflare onion services. Again, in general, I agree this is a complete improvement for non-onion-service using Tor browser users of Cloudflare customer sites. And I think it's a good pattern for sites/hosts/CDNs to follow (i.e. onions as HTTP alt services) in the current absence of acceptably secure/decentralized DNS for onion services. But direct onion service access hosted by the endpoint is always preferred over a middleman if it is an option.