lambau

Pond uses Tor for metadata protection. Vuvuzela is another recent messenger that protects metadata.

> That makes your network insecure, not my page.

Sometimes you NEED to use an insecure network due to censorship (example: Tor or VPN).

Consider Tor: in this case, your "ISP" is a random server on the internet. Maybe your Comcast or TimeWarner ISPs will not be malicious, but with Tor, any one in the world can register to be an exit node/ISP. HTTPS helps protect you from attacks in this "random ISP" model.

I agree! There is TCPCrypt, for example: http://www.tcpcrypt.org/

Tor is a tool for circumventing censorship. HTTPS is an important part of using Tor to surf the web: 1) it protects the user from bad exits that could inject malicious javascript into a page and 2) some exits refuse HTTP connections and only allow HTTPS.

Maybe HTTPS makes it easier to censor in theory, but in practice it helps fight censorship by enabling Tor.

> I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings.

That is correct. I have not been able to get passed a Cloudflare captcha over tor for any website.

Please do not put Cloudflare in front of your site. It makes it impossible for tor and VPN users to view your site since they have to solve an impossible captcha to even see the static content.

HTTPS is especially important for Tor users. With tor, all HTTP requests pass through a random exit node, who may be malicious. If the site is not using HTTPS, then the exit node can inject malicious javascript into the page. By deploying HTTPS, you are also helping tor users to browse the web more securely.

Who is rightfully concerned about the overhead of an SSL handshake in 2016?