Hacker News Reader

Those have nothing to do with "what the browser exposes". They are exposed regardless of what you use to connect.

But the browser knows them too and the site can get you to reveal it, even behind a vpn.