I don't think they are presenting it accurately. I think what they are indicating is it was something like this: Login page ... $code_to_embed_capt

I don't think they are presenting it accurately. I think what they are indicating is it was something like this: Login page ... $code_to_embed_captcha ... I believe $code_to_embed_captcha was returning something along the lines of http://REAL_SERVER_IP/captcha.jpg http://REAL_SERVER_IP/captcha.jpg instead of http://ONION_ADDRESS/captcha.jpg http://ONION_ADDRESS/captcha.jpg This wouldn't allow you to identify users, the request for captcha.jpg is still routed through TOR. However it does reveal the true IP of the server.