CloudFlare proposing a browser addon to bypass CAPTCHAs for TOR users:

https://social.mikegerwitz.com/url/8140

(Without studying the spec in too much detail): It uses a blind signature protocol allowing the client to generate bypass tokens without future correlation. That's good.

Unfortunately, because it requires that the user use a plugin, this creates two groups of Tor users: those that are using this protocol and those that aren't. This more information that can be used---with other information---to aid in de-anonymizing users.

CloudFlare stores cookies today, yes, but they can be ephemeral with good client cookie policies. A browser plugin usually persists sessions---even if the tokens don't, the fact that it is _installed_ does.