The user-agent detection definitely isn’t great. If it doesn’t recognize a client, it just says unknown. But that wasn’t the main point of the post anyway, this was just meant as a quick proof of concept for anyone curious.
I feel like there isn’t a real way to fix this, since lemmy isn’t a single service, like I can choose any image host I want. The only way I could think of would be to have your instance download the images but that’s currently not even support on the mastodon alike platforms even. The only thing you can do on Mastodon that I’m aware of is cache the images on your own server which could get costly
I would say a user agent spoofer would be more useful for this particular image. The Mozilla team recommends User-Agent Switcher and Manager for Firefox users.
TL;DW: Click on the extension icon, use the drop-down lists to find a browser and OS, select a pre-configured user-agent string from the list, and click “apply (container)” or “apply (all windows)”. Having your user-agent string change randomly with each request is possible but requires writing a bit of JSON in the options.
That’s weird. The extension should definitely work with the image, as that’s what I used when building this quick demo. Does the content of a site like this update?
By not using internet. No, seriously, if you access something over the internet, you will leave tracks. This here post is nothing new or inherently scary on its own. I used to have forum signatures that would tell people what browser they were using or from what IP they were coming.
What you really want to do is disable third party cookies on everything you own. That (and things like hsts super cookies) is what tracks you.
If you’re using an app to browse Lemmy, you might ask for their implementation to reject cookies and fingerprinting attempts when displaying images and other embeddables.
a minute later edit: And yeah, if you don’t like web services to know the IP address given to you by your ISP, VPN is a decent option.
No, seriously, if you access something over the internet, you will leave tracks.
It’s quite the difference between leaving tracks on only one provider’s servers (where your account is hosted), and leaving tracks all over the internet.
There were a few comments under this post about how (easily!) this could be used to find out the IP address and though it the rough location of a commenter.
Lemmy proxying image loads won’t fix this issue at all. Unless you only ever access resources through it, which you won’t. It will even make the problem worse by exposing a single attack surface.
Don’t trust the collection of random internet services to protect interests they are not set out to protect. You wanna hide your IP? Use VPN or Tor.
It’s not nearly as nefarious as people seem to think. Effectively all applications that access web resources send along what they are and basic platform information.
This is part of how the application asks for content in a way that it can handle
It does a little to let you be tracked, but there are other techniques that are far more reliable for that purpose.
I posted this further up, but I think it’s worth pasting here too:
I suspect with a coordinated pool of posts or multiple comments on the same post, you could narrow that IP address down to an actual user account.
When a new comment is posted by a user, store, against their username, all IP addresses that visited since the last comment in that thread (by anyone). When a second comment is posted by a user, remove any IP addresses that don’t appear in both lists.
I suspect you would have a very short list after two comments, and a single address after 3. It would also be extremely easy to both lure someone into viewing an image and bait them into multiple replies. Geolocate that IP and you know know vaguely where that user lives.
Lemmy clients should really include an option to group or only show the first instance of a link for cases like this; where the same link is posted to multiple places.
it is because the website providing the image is overloaded and cannot create an image.
You just have to reload the image and eventually you will see one.
Add comment