This article is based on material from a BitcoinTalk member - the forum user mocacinno, who for several years in a row encountered the same problem: mixer operators stubbornly use Cloudflare and Google Analytics, sincerely not understanding what they have done. We have reworked his posts into a practical guide - what to look at when you use exchangers and mixers.
Every time you use a crypto service - an exchanger, a mixer, a P2P platform - you entrust it not only with your coins, but also with your privacy. And often this service destroys that privacy. Not because it is malicious, but because its owner chose convenience over security.
Below is a simple verification system that will help you understand whether a particular service is worth trusting. It is based on principles that mocacinno broke down using mixers as an example, but they apply to any crypto service that processes information you do not want to share with anyone.
The principle you need to understand: where privacy breaks
To understand what to pay attention to, you need to grasp one simple principle - what a secure connection looks like and how it breaks.
The ideal scenario: HTTPS with your own certificate
When you visit a site over HTTPS, a handshake takes place between your browser and the server:
- You resolve the domain via DNS.
- You send unencrypted data to the server: random data, padding, and a list of supported ciphers.
- The server responds with unencrypted data: random data, padding, and its public key.
Based on the exchange, a symmetric encryption key is generated. The server's public key is used to encrypt communication from the client to the server, so the symmetric key is never transmitted in the clear.
From that moment on, every packet between you and the server is encrypted. Even if a network node operator intercepts the packets, they cannot extract the key.
What this gives you: only you and the server know which addresses you request and which deposit addresses you receive. Law enforcement and data center operators can intercept the packets, but they cannot read their contents. As long as the service is honest, you are relatively protected.
Important: this does not mean your ISP does not know that you visited a mixer. It sees the fact of the visit itself, it simply does not see what exactly you did there. If you want to hide that too - use a VPN, Tor Browser, or a combination.
Where everything breaks: Cloudflare as MITM
Cloudflare is a "man-in-the-middle" (MITM). Formally, it looks like this:
- You resolve the domain and get the IP address of Cloudflare, not the service's server.
- You complete the handshake with Cloudflare, not with the mixer's server.
- A symmetric key is generated between you and Cloudflare.
When you send data, Cloudflare decrypts it, looks to see whether it can respond from cache. If not, Cloudflare itself requests the data from the mixer's server, creates a new key with it, and re-encrypts the packet.
The response from the mixer is decrypted by Cloudflare, stored in cache, and only then re-encrypted for you.
What this means in practice:
- Cloudflare sees all your data in unencrypted form: deposit addresses, withdrawal addresses, amounts, time.
- Cloudflare stores this in cache - sometimes for years.
- Cloudflare is an American company. The United States is known for a very lenient stance on privacy when intelligence agencies are involved.
Even if network node operators cannot decrypt your packets, they can intercept them. If Cloudflare hands over the keys (at the request of law enforcement, due to a breach, or through social engineering), all intercepted historical packets can be decrypted.
The irony: Cloudflare can be used on a blog, a forum, or a site selling masks - that is fine. But on banking apps, gun stores, and mixers - it is unacceptable.
An additional vector: external scripts
If a site has Google Analytics, a remote jQuery, or other third-party scripts connected, these services receive your IP, timestamp, browser fingerprint, the pages you visited before and after, and much more. For a mixer, this means that Google (and through it, intelligence agencies) may know that you visited a site that is banned in your country.
Important: seemingly, this is the most basic information that owners of exchangers and crypto services without KYC should take into account by default. But just look once at the code of some exchanger - and you will see all kinds of analytics systems right in the HTML code.
What to pay attention to when using a crypto service
Here is a practical checklist. If a service fails at least several points, it is worth thinking twice.
Check whether the service uses Cloudflare
How to check:
Open the browser console (F12) -> Network tab.
Look at the IP address to which the connection is going. If it is in a Cloudflare range (for example, 104.x.x.x, 172.67.x.x), the service is behind Cloudflare.
Or use services like cryptcheck.fr or ssllabs.com - they will show who issued the SSL certificate. If the certificate was issued by Cloudflare, it is MITM.
What this means for you: Cloudflare sees all your data in the clear. If the service works with sensitive information, this is a red flag.
Check for external scripts
How to check:
In the browser console, look at which external domains are being loaded.
If you see google-analytics.com, googletagmanager.com, jquery.com, cloudflare.com, etc., the service is transmitting data to third parties.
What this means for you: Google and other companies receive information about your visit, even if the service itself does not pass data to them directly.
Check whether the service has a Tor mirror (and whether it works)
How to check:
Look for a link to a .onion address on the site.
Check whether it is actually a mirror and not just a redirect to the main site.
What this means for you: a Tor mirror is a good sign, but only if it is actually used. Most users will not even realize that the service is behind Cloudflare and will not switch to Tor. If the service does not actively promote its Tor mirror, this is not a solution to the problem.
Check whether the service uses HTTPS with its own certificate
How to check:
Look at the site's certificate (click the lock in the address bar).
If the certificate was issued not by Cloudflare but by the service itself or a trusted CA, that is a good sign.
If the certificate was issued by Cloudflare, it is MITM.
What this means for you: your own certificate means that only the service and you see the data. This is the best-case scenario.
Check whether the service caches data
How to check:
This is difficult to verify directly, but if the service is behind Cloudflare, it almost certainly caches.
If the service claims it does not cache but uses Cloudflare, that is a lie.
What this means for you: caching means your data is stored somewhere other than the service's server. It can be requested, stolen, or lost.
Check reputation and transparency
How to check:
Read forums, reviews, and the service's history.
If the service owner refuses to discuss security issues and responds with "everyone does it this way," that is a red flag.
What this means for you: if the owner does not understand the risks or does not want to fix them, he does not care about your privacy.
Example: what this looks like in practice
Imagine Bob - an IT specialist from Algeria, where Bitcoin is banned. He earned 0.5 BTC legally and wants to mix the coins to protect himself. He finds the mixer i-am-a-mixer-that-uses-cloudflare-ssl.com - beautiful pictures, animation, an affiliate program.
Bob does not check that the site is behind Cloudflare. He does not notice Google Analytics or the remote jQuery. He enters 1TotallyAnonymousxxx for withdrawal and sends 0.5 BTC to 1DepositYourDirtyFundsHereXXX.
A year later, the secret police of Algeria decide Bob is a threat. They get his IP from the provider and pass it to an American agency. The agency contacts Google and Cloudflare. Cloudflare reports: Bob's IP created a session on the mixer, deposit address 1DepositYourDirtyFundsHereXXX is linked to 1TotallyAnonymousxxx, funded from 1BobDirtyXXX. Google adds timestamps, browser, and pages before and after.
Bob was arrested and tortured, while his family was left to fend for themselves.
The moral: had Bob checked the service against the checklist above, he would have seen Cloudflare, Google Analytics, and external scripts - and might have chosen a different service.
What to do if a service fails the check
Do not use it. Find another service that uses its own certificate and is not connected to Cloudflare.
If you do use it, use Tor. Tor will hide your IP from Cloudflare and Google, but it will not hide the data from the service itself if it is behind Cloudflare.
Use a VPN. This will hide your IP from your ISP, but not from Cloudflare.
Combine. VPN + Tor + a separate wallet for each operation.
Demand transparency from services. If the service owner refuses to discuss security, do not use it.
Privacy in crypto services is not paranoia. It is basic hygiene. If a service uses Cloudflare as MITM, connects Google Analytics and external scripts, it does not care about your privacy. And perhaps it does not understand what it is doing.
Check services before using them. Do not trust beautiful pictures and animation. Look at certificates, external scripts, and IP addresses.
Your privacy is in your hands.
Every time you use a crypto service - an exchanger, a mixer, a P2P platform - you entrust it not only with your coins, but also with your privacy. And often this service destroys that privacy. Not because it is malicious, but because its owner chose convenience over security.
Below is a simple verification system that will help you understand whether a particular service is worth trusting. It is based on principles that mocacinno broke down using mixers as an example, but they apply to any crypto service that processes information you do not want to share with anyone.
The principle you need to understand: where privacy breaks
To understand what to pay attention to, you need to grasp one simple principle - what a secure connection looks like and how it breaks.
The ideal scenario: HTTPS with your own certificate
When you visit a site over HTTPS, a handshake takes place between your browser and the server:
- You resolve the domain via DNS.
- You send unencrypted data to the server: random data, padding, and a list of supported ciphers.
- The server responds with unencrypted data: random data, padding, and its public key.
Based on the exchange, a symmetric encryption key is generated. The server's public key is used to encrypt communication from the client to the server, so the symmetric key is never transmitted in the clear.
From that moment on, every packet between you and the server is encrypted. Even if a network node operator intercepts the packets, they cannot extract the key.
What this gives you: only you and the server know which addresses you request and which deposit addresses you receive. Law enforcement and data center operators can intercept the packets, but they cannot read their contents. As long as the service is honest, you are relatively protected.
Important: this does not mean your ISP does not know that you visited a mixer. It sees the fact of the visit itself, it simply does not see what exactly you did there. If you want to hide that too - use a VPN, Tor Browser, or a combination.
Where everything breaks: Cloudflare as MITM
Cloudflare is a "man-in-the-middle" (MITM). Formally, it looks like this:
- You resolve the domain and get the IP address of Cloudflare, not the service's server.
- You complete the handshake with Cloudflare, not with the mixer's server.
- A symmetric key is generated between you and Cloudflare.
When you send data, Cloudflare decrypts it, looks to see whether it can respond from cache. If not, Cloudflare itself requests the data from the mixer's server, creates a new key with it, and re-encrypts the packet.
The response from the mixer is decrypted by Cloudflare, stored in cache, and only then re-encrypted for you.
What this means in practice:
- Cloudflare sees all your data in unencrypted form: deposit addresses, withdrawal addresses, amounts, time.
- Cloudflare stores this in cache - sometimes for years.
- Cloudflare is an American company. The United States is known for a very lenient stance on privacy when intelligence agencies are involved.
Even if network node operators cannot decrypt your packets, they can intercept them. If Cloudflare hands over the keys (at the request of law enforcement, due to a breach, or through social engineering), all intercepted historical packets can be decrypted.
The irony: Cloudflare can be used on a blog, a forum, or a site selling masks - that is fine. But on banking apps, gun stores, and mixers - it is unacceptable.
An additional vector: external scripts
If a site has Google Analytics, a remote jQuery, or other third-party scripts connected, these services receive your IP, timestamp, browser fingerprint, the pages you visited before and after, and much more. For a mixer, this means that Google (and through it, intelligence agencies) may know that you visited a site that is banned in your country.
Important: seemingly, this is the most basic information that owners of exchangers and crypto services without KYC should take into account by default. But just look once at the code of some exchanger - and you will see all kinds of analytics systems right in the HTML code.
What to pay attention to when using a crypto service
Here is a practical checklist. If a service fails at least several points, it is worth thinking twice.
Check whether the service uses Cloudflare
How to check:
Open the browser console (F12) -> Network tab.
Look at the IP address to which the connection is going. If it is in a Cloudflare range (for example, 104.x.x.x, 172.67.x.x), the service is behind Cloudflare.
Or use services like cryptcheck.fr or ssllabs.com - they will show who issued the SSL certificate. If the certificate was issued by Cloudflare, it is MITM.
What this means for you: Cloudflare sees all your data in the clear. If the service works with sensitive information, this is a red flag.
Check for external scripts
How to check:
In the browser console, look at which external domains are being loaded.
If you see google-analytics.com, googletagmanager.com, jquery.com, cloudflare.com, etc., the service is transmitting data to third parties.
What this means for you: Google and other companies receive information about your visit, even if the service itself does not pass data to them directly.
Check whether the service has a Tor mirror (and whether it works)
How to check:
Look for a link to a .onion address on the site.
Check whether it is actually a mirror and not just a redirect to the main site.
What this means for you: a Tor mirror is a good sign, but only if it is actually used. Most users will not even realize that the service is behind Cloudflare and will not switch to Tor. If the service does not actively promote its Tor mirror, this is not a solution to the problem.
Check whether the service uses HTTPS with its own certificate
How to check:
Look at the site's certificate (click the lock in the address bar).
If the certificate was issued not by Cloudflare but by the service itself or a trusted CA, that is a good sign.
If the certificate was issued by Cloudflare, it is MITM.
What this means for you: your own certificate means that only the service and you see the data. This is the best-case scenario.
Check whether the service caches data
How to check:
This is difficult to verify directly, but if the service is behind Cloudflare, it almost certainly caches.
If the service claims it does not cache but uses Cloudflare, that is a lie.
What this means for you: caching means your data is stored somewhere other than the service's server. It can be requested, stolen, or lost.
Check reputation and transparency
How to check:
Read forums, reviews, and the service's history.
If the service owner refuses to discuss security issues and responds with "everyone does it this way," that is a red flag.
What this means for you: if the owner does not understand the risks or does not want to fix them, he does not care about your privacy.
Example: what this looks like in practice
Imagine Bob - an IT specialist from Algeria, where Bitcoin is banned. He earned 0.5 BTC legally and wants to mix the coins to protect himself. He finds the mixer i-am-a-mixer-that-uses-cloudflare-ssl.com - beautiful pictures, animation, an affiliate program.
Bob does not check that the site is behind Cloudflare. He does not notice Google Analytics or the remote jQuery. He enters 1TotallyAnonymousxxx for withdrawal and sends 0.5 BTC to 1DepositYourDirtyFundsHereXXX.
A year later, the secret police of Algeria decide Bob is a threat. They get his IP from the provider and pass it to an American agency. The agency contacts Google and Cloudflare. Cloudflare reports: Bob's IP created a session on the mixer, deposit address 1DepositYourDirtyFundsHereXXX is linked to 1TotallyAnonymousxxx, funded from 1BobDirtyXXX. Google adds timestamps, browser, and pages before and after.
Bob was arrested and tortured, while his family was left to fend for themselves.
The moral: had Bob checked the service against the checklist above, he would have seen Cloudflare, Google Analytics, and external scripts - and might have chosen a different service.
What to do if a service fails the check
Do not use it. Find another service that uses its own certificate and is not connected to Cloudflare.
If you do use it, use Tor. Tor will hide your IP from Cloudflare and Google, but it will not hide the data from the service itself if it is behind Cloudflare.
Use a VPN. This will hide your IP from your ISP, but not from Cloudflare.
Combine. VPN + Tor + a separate wallet for each operation.
Demand transparency from services. If the service owner refuses to discuss security, do not use it.
Privacy in crypto services is not paranoia. It is basic hygiene. If a service uses Cloudflare as MITM, connects Google Analytics and external scripts, it does not care about your privacy. And perhaps it does not understand what it is doing.
Check services before using them. Do not trust beautiful pictures and animation. Look at certificates, external scripts, and IP addresses.
Your privacy is in your hands.
