8 ms·
FYI, it's very NSFW in the back-end. Your browser is sending requests to obvious porn servers when you hit this link so it can test if you're logged in to them
by Pxtl 10y ago
FYI, it's very NSFW in the back-end. Your browser is sending requests to obvious porn servers when you hit this link so it can test if you're logged in to them.
- throwanem 10y agoYeah, that would've been nice to know ahead of time. Why not, for example, trigger the test when someone clicks a button, rather than taking someone's page visit as permission to try lighting up their organization's content filter?
- ktta 10y agoI think it helps in conveying the fact that it is a vulnerability not a feature. So any website (even your own company's internal one) can check stuff like this. And you can't do anything about it. Other than always using private browsing for anything you don't want your company/anyone else to know about.
- throwanem 10y agoI mean, if somebody is logged into YouPorn from work, that's not a problem I expect the developer of a tool like this to solve. What I expect the developer of a tool like this to do is not create problems by just arbitrarily making HTTP requests to porn sites without a prompt or a chance to opt out. That's a dick move.
- drvdevd 10y agoWhen I first read that it was making these requests here in the comments, my reaction was similar. But then upon reflection, I don't think there's a problem for the author here. Why? Because all I did was click the link. Meaning if I was behind a corporate firewall or the like, this sort of thing could be happening all the time and unless I was always tracing requests in my browser or via MITM or logging DNS, I'd have no way of knowing. Personally I view this as a browser and/or protocol issue (the kind that has trickled down from the origins of the web) and really can't fault the author for it. In fact I think it's appropriate the author left these requests in as it reflects an actual attack scenario better perhaps.
- throwanem 10y agoThe point I'm making is that it's not necessary to hit a porn site in order to get the point across, and there are HN users whose organizations observe and don't care for that kind of thing.
- TeMPOraL 10y agoThen how can such organizations handle other people randomly putting references to porn sites on their websites? With today's Internet being what it is, you can't assume that a request to YouPorn means someone is browsing porn at work. For all you know, the request could have been sent by an ad. Then again, businesses in general aren't exactly paragons of intelligence either, so I wouldn't be surprised if someone made a fuss about it...
- coverband 10y agoAbsolutely!... If your company is doing web filtering, it will report an attempted hit from your browser to the YP site.
- oldmanjay 10y agoYet another inequality to throw in the hopper
- ge96 10y agoIn bird culture, this is considered a dick move.
- sperglord 10y agoI believe using private browsing wouldn't matter. The IP I'm browsing from is still going to try pinging all those porn servers, and that's what's getting logged in the filter, not my browser history.
- ktta 10y agoIn my second paragraph, I was actually talking about your company sending such requests to know what you are logged into. Doesn't matter if you're using it right now. If you're logged in from days before, your cookies will be there. In incognito they won't be.
- JoshMnem 10y agoPrivacy Badger will stop that tool if you edit the settings.
- Hondor 10y agoWhat a surprising problem. If the boss mistakenly accuses you of watching porn - why not explain why they're wrong and show them the site? If they won't accept that, then it means you're in danger with any web surfing you do at work and should already not be clicking random links. It's not the site's fault, it's your company's fault and your own for not protecting yourself against breaking their rules.
- derefr 10y agoPersonally, the idea that there's a network my traffic flows over, where that traffic is sniffed such that its content could potentially result in things like me losing my job, is just debilitating to me. If I worked for such a company, all my traffic would be flowing over a VPN, full-stop.
- draugadrotten 10y ago> If I worked for such a company, all my traffic would be flowing over a VPN, full-stop. When you work for such a company, all VPNs are blocked and prohibited, full-stop. Source: worked for such a company
- oarsinsync 10y agoPretty standard in any reasonably secure financial services org. All direct Internet access is blocked and prohibited, with all attempts to access the Internet (tcp/80, tcp/443) transparently proxied via Bluecoat/Websense/Forcepoint/etc proxies, which filter based on URL categorisation. WSS generally doesn't work in this kind of environment. Everything else is dropped. Any attempts to bypass filtering is a violation of IT policy and is sackable. Visiting sites that are blocked gets logged, doesn't generally get flagged up unless is a daily occurrence, and the first assumption is usually malware. Source: Worked for several such companies, was responsible for perimeter security in some.
- 0942v8653 10y agoA more SFW version (took out YouPorn): http://codepen.io/anon/pen/ALdqox/right/ http://codepen.io/anon/pen/ALdqox/right/ This version connects to squareup.com, twitter.com, www.facebook.com, accounts.google.com, accounts.google.com, plus.google.com, login.skype.com, www.flickr.com, www.spotify.com, www.reddit.com, www.tumblr.com, www.expedia.de, www.dropbox.com, www.amazon.com, www.pinterest.com, www.netflix.com, de.foursquare.com, eu.battle.net, store.steampowered.com, www.academia.edu, stackoverflow.com, accounts.google.com, github.com, medium.com, news.ycombinator.com, carbonmade.com, courses.edx.org, www.spiegel.de, slack.com, www.khanacademy.org, www.paypal.com
- Zeklandia 10y agoThis one actually works for me! The other said that I was using Privacy Badger since it couldn't detect anything. I'm not, but I am using uBlock Origin. This one is only wrong about a couple (it doesn't register, for example, that I am logged in to G+, Khan Academy, Steam, Amazon, PayPal, or Skype).
- Ph0X 10y agoDoesn't uBlock have a filter specifically for privacy (off by default I believe).
- subliminalpanda 10y agoIt has several you can choose from in fact, can be enabled in the options pane.
- JeremyNT 10y agoI actually had several of the extra filters enabled already, but only once I added "Fanboy's Enhanced Tracking List"[0] did uBlock Origin successfully block this technique. I'm not sure whether any of the other filters would accomplish the same result. After enabling this filter, 0942v8653's version also failed. [0] https://www.fanboy.co.nz/enhancedstats.txt https://www.fanboy.co.nz/enhancedstats.txt
- 10y ago
- user5994461 10y agoTried it and... imagine my disappointment to find out it's ONLY connecting to youporn. "very NSFW" and "serverS" were overstatements.
- Pxtl 10y agoI figured "warn first, confirm the details later".
- echelon 10y agoThis is definitely NSFW if your workplace monitors the domains you connect to.
- user5994461 10y agoThe monitoring must have funny statistics with all the ads going to <explicitdomain>.com
- xexers 10y agoCorporate IT admins, care to comment here? If you see a single connection to youporn, do alarm bells go off?
- dataharry 10y agoYes, and then we bring out the fire hoses
- simplemath 10y agoNo one is actually watching.
- ganeshkrishnan 10y agoYes, we initiate protocol zero once the sirens sound off. IT team then calls in air support
- mablap 10y agoWell, that was not very nice. Should have asked confirmation. I clicked on the link thinking there would be an explanation of what this project does.
- Capira 10y agoI removed the request to Youporn. Sorry if it caused any trouble.