Hacker News Reader

Nothing after the # will be sent over HTTPs but doesn't use of URL means its lost if you loose the URL - wouldn't local web storage be more 'secure' and also possibly syncable to other devices?

View on HN

> Nothing after the # will be sent over HTTPs

I notice it wants to run Cloudflare insights. Do they track this?

They do, so in theory everything after the '#' is not sent, however it frequently sends a request to "https://notepadtab.com/cdn-cgi/rum?" which is part of Cloudflare Analytics (https://www.cloudflare.com/en-au/web-analytics/). The payload includes "timingsV2" data, which leaks the hash part to the server.

Reply on news.ycombinator.com