this post was submitted on 11 Aug 2023
567 points (96.4% liked)

Privacy

31609 readers
275 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

Note: This post now archived and as such no longer works

An external image showing your user-agent and the total "hit count"

you are viewing a single comment's thread
view the rest of the comments
[–] A_A 17 points 1 year ago* (last edited 1 year ago) (3 children)

Exactly. The text of this post is simply :

![An external image showing your user-agent and the total "hit count"](https://trilinder.pythonanywhere.com/image.jpg)
I get the same result when I browse directly to the link.

So, if OP links a malcious website we have a problem ... (?).

[–] [email protected] 11 points 1 year ago (1 children)

Oh dangit, it's simpler than I thought. So the only data being sent is...just whatever is sent in your average GET request.

[–] [email protected] 13 points 1 year ago

Yes. It's also a pretty standard way of serving images. A lot of Email clients do that too.

That's also how these services that show you when a email is read work.

[–] [email protected] 7 points 1 year ago* (last edited 1 year ago)

Not really that huge of a problem. When making requests you also usually send a header which includes the user agent.

The program just logs how many times the image has been requested and it reads the user agent data. No Javascript is actually executed.

Well it might be possible to have a XSS somehow but I haven't really done much research into this possibility.

In general it's a pretty standard way of handling embedded images. Email does this too. That's how you have these services that can check if someone read a mail

[–] A_A 1 points 1 year ago

okay so I make a test here, with this :
![www.example.com](http://www.example.com/)


www.example.com

I believe this web page doesn't load automatically.

FWiThe domain names example.com, example.net and example.org are second-level domain names in the Domain Name System of the Internet. They are reserved by the Internet Assigned Numbers Authority (IANA) at the direction of the Internet Engineering Task Force (IETF) as special-use domain names for documentation purposes. (...wikipedia)