i made strong technical claims about the inability cashu to provide real privacy due to browser fingerprinting. these criticisms are based on the parts of my career involving web security, but we don't trust, we verify. here's a demonstration of the problem:
even cloudflare knows who you are. they are not your browser, or the page that you think you're visiting. they wouldn't see amounts, but wallets frequently make change before sending funds, and swap after receiving them. if a mint is behind cloudflare, they will have fingerprinted both the sender and receiver, and recorded the time proximity and ordering. since they are cloudflare, they also know who you are from everything else you do on the internet
this is the cost of using web browsers, and there's very little anyone can do about it at this point. the best we can do is design distributed systems with intermediate layers, but this breaks branding and discovery
https://hacktivis.me/articles/cloudflare-turnstile-webgl-fingerprinting
ynniv
npub12a…x6fdh
2026-05-31 17:55:31 GMT
Author Public Key
npub12akj8hpakgzk6gygf9rzlm343nulpue3pgkx8jmvyeayh86cfrus4x6fdhPublished at
2026-05-31 17:55:31 GMTEvent JSON
{
"id": "51ce2968830b17b9479746c27f7f9e6e95f548982aecc777091fcedc839b1bc0",
"pubkey": "576d23dc3db2056d208849462fee358cf9f0f3310a2c63cb6c267a4b9f5848f9",
"created_at": 1780250131,
"kind": 1,
"tags": [
[
"r",
"https://hacktivis.me/articles/cloudflare-turnstile-webgl-fingerprinting"
]
],
"content": "i made strong technical claims about the inability cashu to provide real privacy due to browser fingerprinting. these criticisms are based on the parts of my career involving web security, but we don't trust, we verify. here's a demonstration of the problem: \n\neven cloudflare knows who you are. they are not your browser, or the page that you think you're visiting. they wouldn't see amounts, but wallets frequently make change before sending funds, and swap after receiving them. if a mint is behind cloudflare, they will have fingerprinted both the sender and receiver, and recorded the time proximity and ordering. since they are cloudflare, they also know who you are from everything else you do on the internet\n\nthis is the cost of using web browsers, and there's very little anyone can do about it at this point. the best we can do is design distributed systems with intermediate layers, but this breaks branding and discovery\n\nhttps://hacktivis.me/articles/cloudflare-turnstile-webgl-fingerprinting",
"sig": "84fc53929454ff098263dc998b793b6c95f15c7483ed305ae30130f2ec4548bb59cb1dfb842687f7386a975f453d4d979d293cbe1ad3e106bb12afba4aa1f88f"
}