this post was submitted on 11 Aug 2023

90 points (88.8% liked)

Lemmy

12546 readers

27 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.

founded 4 years ago

MODERATORS

nutomic@lemmy.ml

This post knows where you're viewing it from (Lemmy doesn't proxy external images) [ARCHIVED] (lemmy.ml)

submitted 1 year ago* (last edited 1 year ago) by TriLinder@lemmy.ml to c/lemmy@lemmy.ml

18 comments fedilink hide all child comments

Note: This post now archived and as such no longer works

An external image showing your user-agent and the total "hit count"

all 20 comments

sorted by: hot top controversial new old

[–] TriLinder@lemmy.ml 31 points 1 year ago (1 children)

This is possible because Lemmy doesn't proxy external images but instead loads them directly. While not all that bad, this could be used for Spy pixels by nefarious posters and commenters.

Note, that the only thing that I willingly log is the "hit count" visible in the image, and I have no intention to misuse the data.

[–] andscape@feddit.it 2 points 1 year ago (1 children)

Interesting demo! Does this use the user agent string for identifying clients?

[–] TriLinder@lemmy.ml 2 points 1 year ago

It does

[–] janNatan@lemmy.ml 20 points 1 year ago (1 children)

Unknown mobile client. Yeah, I'm pretty mysterious like that.

[–] archengel@nichenerdery.duckdns.org 3 points 1 year ago

Lol, mysterious and slightly confused (mobile?)

[–] DougHolland@lemmy.ml 11 points 1 year ago (1 children)

"You are viewing this from Firefox on Windows."

I should worry that this info is exposed?

[–] nathanjell@infosec.pub 6 points 1 year ago

Probably not. Every time your web browser makes a request to a server, it always transmits some "user agent" describing itself. By default, it'll be something that boils down to "Safari version X on macOS version Y" or "Firefox version A on Windows version B" or something similar. You can often change your user agent (on desktop browsers at least) of you care.

What can someone do with this specific info? Well, not a huge amount. It can be used as a sort of a fingerprint - the more unique a browser's user agent, the more easy it is to target you as a demographic or individual. It could be used in phishing, to legitimize spam - think, "I know you use Firefox on Windows, you don't want to know what else I know!" But honestly, for the vast majority of people (in my opinion) the reality is that letting the server know your user agent isn't going to be doing much.

To be fair, user agent is one of many ways that remote services can track you and identify you.

[–] wopazoo@hexbear.net 8 points 1 year ago

on hexbear, all i get is

*removed externally hosted image*

[–] flathead@quex.cc 7 points 1 year ago* (last edited 1 year ago) (1 children)

I did not know until now that it is possible to embed external images within posts and replies. I thought the only option was to upload to your instance.

this is bothersome, but if you use a VPN then at least there's that.

otherwise it's feasible to track captured addresses based on which posts they read by posting an external image in the post or a reply.

if you are seeing images in this post, then your client address is visible to any external image hosts.

[–] andscape@feddit.it 7 points 1 year ago (2 children)

Can countermeasures be implemented in the clients to mitigate privacy risks, while not having to proxy images?

[–] flathead@quex.cc 3 points 1 year ago (1 children)

no. the remote server will log the requests based on the client address. it is a good argument for using a vpn.

[–] andscape@feddit.it 1 points 1 year ago* (last edited 1 year ago) (1 children)

Oh I mean, sure, but I don't think IP logging is the main privacy concern with spy pixels.

I'm assuming this trick uses the user agent string and other request metadata to identify clients. Even if it didn't recognize Jerboa as a client, it did guess that I was on mobile. That's not possible just by tracking IPs, unless they're cross-referencing it with other datasets. Also, I was on VPN anyway, so the IP would have been useless.

It should be possible for clients to obfuscate/fake the metadata of image requests to make tracking with spy pixels less effective.

[–] TriLinder@lemmy.ml 1 points 1 year ago

Yup, I'm parsing the user agent with the user_agents Python library.

[–] psud@aussie.zone 2 points 1 year ago (1 children)

At it's basic level it will capture your IP address, but it won't really tie the IP to a user name, and there's not a role lot you can do with it

Attacks I can think of:

target advertising at users in a particular lemmy community
get a collection of IP addresses of people with specific problems or beliefs (indicated by membership in a lemmy community) to target with malware

A VPN would protect you in this case, but you need to be a bit of a privacy nut to also protect yourself from things that identify for advertising right now

[–] TriLinder@lemmy.ml 1 points 1 year ago* (last edited 1 year ago) (1 children)

If you wanted to target a specific user, you could always send a DM with the image

[–] psud@aussie.zone 1 points 1 year ago

You could also correlate time of your log entry to order of comments sorted by new, with errors from the few clients that don't load images

[–] Faresh@lemmy.ml 6 points 1 year ago

Would be interesting to use such an embedded image to acquire some statistics on lemmy users. We could answer questions like: What percentage of lemmy users use Linux?

[–] chuckd@lemmy.world 5 points 1 year ago

You are viewing this from an unkown (mobile?) client 🤔