[Sir_Cmpwn]

>[0]: Cloudflare provides SSL certificates to millions of web sites

With let's encrypt SSL certs are free and easier to use than ever.

>[1]: Cloudflare now implements Privacy Pass which means Tor users mostly don't see captchas anymore.

Yeah, at the expense of deanomymizing them and only if they install your addon in their web browser!

[jgrahamc]

Privacy Pass does not deanonymize users. Go read the mathematics before making statements like that: https://privacypass.github.io/

[Sir_Cmpwn]

Click "new identity" on the tor button plugin and privacy pass will continue to send the same tokens to the destination. Passes are persisted between browser sessions. It also identifies different people connecting via the same Tor circuit. Am I missing something?

[kentonv]

> Am I missing something?

Yes, you're missing the whole cryptographic underpinnings of Privacy Pass which make it impossible to de-anonymize the user. I know, it sounds like impossible magic at first, but read the papers -- it actually works.

[geofft]

"Same tokens" or "same token"? If it sends a different token from the same set of one-time use tokens, and if their crypto does what it claims to do, then that doesn't deanonymize you.

By different users do you mean that it demonstrates to the server that multiple instances of the plugin are behind the same Tor circuit? If it's using different tokens, I don't think the server gets to learn that; it could be multiple instances of the plugin accessing 30 pages each, or one instance accessing 60 pages.