Please do not put Cloudflare in front of your site. It makes it impossible for tor and VPN users to view your site since they have to solve an impossible captcha to even see the static content.

It's possible to turn off security in the CloudFlare control panel. I think the bigger issue is that CloudFlare has become a single point of interception for MITM'ing huge portions of web traffic.

I'm not sure, but I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings.

But yeah, this NSA slide is extremely relevant to cloudflare: http://cdn01.androidauthority.net/wp-content/uploads/2014/06...

> I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings.

That is correct. I have not been able to get passed a Cloudflare captcha over tor for any website.

I wonder how it's even allowed for CF to do this. "your site" <--- http ---> CF <--- https ---> clients is a poor solution and it only hides that the connection is actually not secure. Isn't this a misuse of many CA's TOS and should result in certificate revocation? Maybe I'm wrong though.

Well, at least for several threat models, "your site to CF" is at least slightly better than "CF to clients". It's not vulnerable to things like unsecured wi-fi sniffing. Then again, neither are self-signed certs and for some reason all browsers consider them even worse than no cert.

On the other hand, it doesn't protect against government spying, but then again, I think some governments straight-up MitM HTTPS traffic anyway. For instance:

https://news.ycombinator.com/item?id=10663843

But putting CloudFlare in front of your site makes mass surveillance even easier than it would be for plaintext traffic without CloudFlare.