They also went out of their way to automatically treat them as more questionable by default. Unless the website operator explicitly whitelists tor, tor users are given a worse experience.

EDIT: Maybe not anymore? See replies

This probably isn't really correct. Their blog says that 94% of the traffic they were getting over Tor was malicious, and since they probably automatically put IPs where a lot of malicious traffic comes from on the CAPTCHA list, my guess is all the Tor nodes got flagged automagically.

What they went out of their way to do, was explicitly make it less painful for legitimate users to use Tor, despite the amount of malicious content they get from Tor. I'd argue for most companies, if 94% of the traffic from somewhere is malicious, the answer is "block it and be done with it", but clearly, Cloudflare actually values Tor and what it stands for enough to come up with a workaround.

"They also went out of their way to automatically treat them as more questionable by default."

nope, you're spreading un-sourced/unconfirmed FUD. Provide a source, or this is just FUD. Tor IPs are treated like any other IP by default, not "more questionable by default".

Perhaps they've changed it since last time I looked a few years ago. You're right, I can't find the tor-specific anything anymore. I ditched Cloudflare years ago and haven't checked back in a while. I rather distinctly remember a default setting that explicitly talked about how it treated Tor users. I don't see that setting anymore.

Not up to the website operator. If Cloudflare blocks TOR or annoys them with Captchas it's Cloudflares problem.

It may be opt-in, but website operators can choose to whitelist Tor even on the free Cloudflare tier.

https://support.cloudflare.com/hc/en-us/articles/203306930-D...

The options for Tor are:

Whitelist (trust)

CAPTCHA (visible challenge which the visitor must interact with to pass)

JavaScript Challenge (visible challenge with less friction, testing the browser)

Block (blacklist -- available only to Cloudflare Enterprise customers)

nope -- as stated, up to the website owner. They can whitelist Tor if they'd like to. Entirely the website owner's decision to make.

Cloudflare is responsible for even providing such a "feature". They aren't off the hook here.

Indeed, our security service allows our customer (the website owner) the option to adequately protect their website.

I'm not sure you actually made a point other than to confirm that we allow website owners to fully whitelist Tor if they'd like to.

opt-in vs. opt-out

Not sure your point. Who exactly do you anticipate is opt-ing?

The website owner's settings defaults to secure, and they can intentionally take action to make the website less secure if they'd like to. That is their decision, of course we do not default to a less secure posture.

What I meant. This default setting is the reason why Cloudflare is not off the hook here. This is the default, so website owners who don't care or know about it won't change it. Like all default settings where you have to actively change it.

Default settings should be secure. As the Cloudflare article points out, 94% of their traffic over Tor was malicious.

then at least force the user to set this. I don't care if the traffic is 'malicious' whatever the definition of that is.