That's all well and good except for, to my knowledge, the reCAPTCHA widget being served by Google and communicating solely with Google as 'jgrahamc points out.

That's all well and good except for, to my knowledge, the reCAPTCHA widget being served by Google and communicating solely with Google as 'jgrahamc points out. The amount of Cloudflare blame in this article does not mesh well with plain logic (I'm kinda disappointed with Cryptome, TBH). I believe the only thing handed to Cloudflare during and after the reCAPTCHA is solved is a token of some kind indicating Google's confidence the user is real. If I'm wrong about this I'd be surprised, because it would then be possible for server-side operators to tamper with Google's machine learning that they're doing with reCAPTCHA users. I'm almost positive these claims are completely false, for example: > Cloudflare can conveniently serve few more images to specific users > Each click on one of the images in the puzzle generates a total of about 50 packets between Tor user's computer and the Cloudflare's server (about half are requests and half are real-time responses from the server.) > The packet group has predictable sizes and patterns, so all the adversary has to do is note the easily detectable signature of the "image click" event, and correlate it with the same on the Cloudflare side. There is no API documentation in the reCAPTCHA widget about your server having to handle real-time requests from users solving the widget or serve images, so there is no Cloudflare side. It wouldn't make sense from an API perspective; why would I have to add a bunch of code to my server to handle this stuff? Google runs that. Look here: https://developers.google.com/recaptcha/docs/display https://developers.google.com/recaptcha/docs/display Do you see a "handle real time image click events" API here for Cloudflare to deploy? You do not. Google would have to build backends for their machine learning and fraud detection algorithms in every language an API user would ever run, and then they also lose obscurity by shipping them. The image click events almost certainly go only to Google, never Cloudflare, so I think whoever sent this tip didn't understand what they were looking at in Wireshark. The possible threat vector here is Google, not Cloudflare. Cloudflare just happens to have deployed Google's reCAPTCHA widely. The article is misleading and incredibly light on important detail; how about even a screenshot of a packet capture showing traffic to Cloudflare? If you want my honest take, I read this as a Tor user annoyed they have to solve reCAPTCHAs on Cloudflare sites (the "insistence" and quoted "protects" bits are the clue) and looking for something to hit them with, and a lack of diligence on Cryptome's part before posting it. https://www.gstatic.com/recaptcha/api2/r20160712125018/recaptcha__en.js https://www.gstatic.com/recaptcha/api2/r20160712125018/recap... is the current version of the widget if anybody is curious, but I haven't looked closely.