Trying a series of passwords is unauthorised access though, surely? Like opening a barrel lock, you try a few positions because that gives up the code eventually, it's not brute force but it's not authorised access by a long shot.

Deciding which way the decision should go must be causing quite a few hours of concentrated legal consideration - there are downsides in both directions for the government.

I don't know. Trying a series of passwords until I get it right is basically my standard login procedure. Guess I have to get to three felonies a day somehow.

Breaking into your own house is not a crime.

What would cause the captcha's image to leak the ip but a regular image on the tor website not?

Something as simple as using 3rd party code for the capcha with a config file that said "host name goes here." Would you be at all surprised to find this in a WordPress plugin or similar?

This is purely guessing, but checking regular images (right size, format, ...) will be the "day-to-day" business of looking after a website. And more often than not the administrator will therefore "Open image in new tab..." and become aware of an incorrect image path.

The Captchas, on the other hand, might have been using an existing software. Remember: These captcha images will have to be autogenerated by a script which, as a convenience to the user, might have used some kind of mechanism to determine "fully qualified" URLs. And this had slipped below the radar, as it's a feature used much less often, and hence likely to receive much less scrutiny.

I think it's pretty likely that these kinds of information leaks can happen when you deal with a larger codebase or system. Hence following the advice of some other HN users, who recommend a strictly firewalled system for this kind of use-case, looks like a prudent thing to do.

The site was misconfigured WRT serving the captcha image resulting in the image link pointing directly to the SR server rather than being routed through TOR.