Hacker News Reader

> Say you remove/don't proxy the ECS information, and I get some generic, non-geo-location aware response back. In the majority of cases, wouldn't my next step be to open a TCP connection to the IP in the response, and immediately leak my full IP address to the other end?

That assumes that the nameserver and the actual server are run by the same party which quite often is not the case.

View on HN

> That assumes that the nameserver and the actual server are run by the same party which quite often is not the case.

Cloudflare can check if nameserver and the actual server are run by different parties, and if so omit subnet information from EDNS response. It is not hard to implement — Google and OpenDNS used to require manual whitelisting to receive EDNS subnet responses (not sure if they still do).

Cloudflare's CDN leaks user's full online identity to Google via reCaptcha, especially when you use Tor. Maybe they should ask Google to be satisfied with client's subnet too?

> Cloudflare's CDN leaks user's full online identity to Google via reCaptcha, especially when you use Tor.

How?

When cloud flare detects suspicious traffic from an ip, it will get served with a reCaptcha every time. Tor exit nodes always get captchas, not sure how much data that would leak though

Reply on news.ycombinator.com