2

If one completes the captcha to bypass the Cloudflare wall when using Tor is their anonymity compromised?

3

No.Cloudflare only knows the IP address of one of the tor exit relays. When you use Tor, you are sending queries through exit relays that are also shared by thousands of other users. Tor users typically see this message when many Tor users are querying Cloudflare in a short period of time. Cloudflare interprets the high volume of traffic from a single IP address (the exit relay you happened to pick) as somebody trying to "crawl" their website, so it slows down traffic from that IP address for a short time. There is another explanation:Due to many crackers have used tor to avoid being tracked when they are doing attack, Cloudflare put all IP address of tor exit relays into a blacklist,when one of those IP address tries to contract to a server that is protected by the Cloudflare wall,it will ask the user to do the captcha. The captcha is a kind of "Turing Test",which is used to confirm a user is a human,not bots. Don`t worry,Cloudflare walls and the servers only knows that you are a human by forcing you completing the captcha.You are still anonymous. Well,someone may worry about browser fingerprint.If you are using Tor Browser,than you should not continue worrying because Tor Browser disguise HTTP headers already.

2

They can get your browser dimensions (for fingerprinting) if using javascript. That's especially a concern when they demand that you have to allow google scripts to run... though it seems that most times I can solve a Cloudfront captcha without allowing google. I could never solve a captcha at google.com itself (on those very few times when I would actually use google to search anything).

[edit: and as far as I know, Cloudflare is also in the spying business, which is how they pay for their "free and helpful" services. All internet corporations have seen how google and facebook have gotten mountains of money by invading privacy and the public doesn't care.]

  • However this fingerprinting can be done be every site on the Internet. Tor Browser does a good job in blurring the fingerprint. Just test some browsers at panopticlick.eff.org – Jens Kubieziel Oct 29 '14 at 6:16
  • Also, there is this site; ip-check.info for showing your reported browser dimensions and it shows changes in real time. (When presented with the challenge for username and password, just cancel that and then click for the test.) – Chinup Oct 29 '14 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.