News for hackers. Stuff that matters.

A comment on Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1). Parent comment

Re:Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.... by Xylakant on Saturday May 04, 2019 @05:44PM (#19829573)
> Say you remove/don't proxy the ECS information, and I get some generic, non-geo-location aware response back. In the majority of cases, wouldn't my next step be to open a TCP connection to the IP in the response, and immediately leak my full IP address to the other end?

That assumes that the nameserver and the actual server are run by the same party which quite often is not the case.

[ Parent | on HN ]
Re:Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.... by altfredd on Saturday May 04, 2019 @10:49PM (#19830802)
> That assumes that the nameserver and the actual server are run by the same party which quite often is not the case.

Cloudflare can check if nameserver and the actual server are run by different parties, and if so omit subnet information from EDNS response. It is not hard to implement — Google and OpenDNS used to require manual whitelisting to receive EDNS subnet responses (not sure if they still do).

Cloudflare's CDN leaks user's full online identity to Google via reCaptcha, especially when you use Tor. Maybe they should ask Google to be satisfied with client's subnet too?

[ Parent | on HN ]
Re:Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.... by devereaux on Sunday May 05, 2019 @01:07AM (#19831280)
> Cloudflare's CDN leaks user's full online identity to Google via reCaptcha, especially when you use Tor.

How?

[ Parent | on HN ]
Re:Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.... by epse on Sunday May 05, 2019 @04:43AM (#19831818)
When cloud flare detects suspicious traffic from an ip, it will get served with a reCaptcha every time. Tor exit nodes always get captchas, not sure how much data that would leak though
[ Parent | on HN ]