Thank you for linking this. The main article being discussed made me think "okay, so administrivia, book stuff, etc. Actually doesn't sound so bad". This link, however, made me realize how emotionally draining the library can be for everyone involved.
According to the URL, it appears to be 1991-2012 changes in precipitation. I suspect the filename is trustworthy (based solely on it coming from NASA) but it might not be.
Well, none of the six results were particularly interesting. Four were variations on Trump's debate comment about having a big penis. One was a news summary which included the world's first successful penis transplant. The last was someone calling Trump "Hillary Clinton with a penis". Nothing authored by someone in the DNC.
One issue here is that recaptcha's traffic signature allows for a passive attacker. So instead of needing to modify the website a user visits, or trick them into going to a domain you control, you are able to just look at the traffic logs and identify them without them knowing.
I'm not too sure about what defines the "distinctive" signature of recaptcha, but I expect timing of when packets of certain sizes were sent (e.g. loading 9 images in quick succession will generate larger packets, and then you often get the incremental couple images with human-length delays between them).
To your aside, MITM seems more likely to happen to the end-user, but it is possible to happen at the Cloudflare-->Website side. We already know that the NSA logs all traffic going over certain backbone routers[1], and that some ISPs are modifying non-HTTPS connections[2]. So if your traffic bounces through certain "bad" networks between Cloudflare and your site, who knows what happens.
Relatedly, Tor recommends all users use HTTPS[3], as otherwise the connection from the exit node to the target site is vulnerable to MITM. Given that there are malicious exit nodes[4], seems like a good idea. But, as the article brings to light, that still doesn't make any guarantees of safety.
When it comes to security, the question of "whom is my attacker?" really determines how much invenstment you make in securing your service.
Many online providers don't care if the NSA is slurping up their data. For example, do you think that Macy's online is going to stick out their necks to protect clothing transactions from the government?
Nope.
Personally, I've seen end-users more worried about MtM close to their endpoint, such as their employers or schools scanning their traffic. They're not trying to evade governments here.
