5 ms·

Were cookies shared across sites in 2008? It seems pretty odd..

fenwick67 10y ago
Images are loaded with the cookies of their own site. Example: go to google.com, then open the console and type the following: var i = document.createElement('img'); i.src= "http://news.ycombinator.com/y18.gif"; http://news.ycombinator.com/y18.gif"; Then look at the cookies sent over the network.
- shiv86 10y ago
  Where do I type it ?
  - jwilk 10y ago
    In Firefox, Ctrl+Shift+K opens the web console.
  - shif 10y ago
    Ctrl + Shift + J in chrome
- artursapek 10y ago
  This is how FB & others track everyone on the web through ad frames, like buttons, etc.
  - hoschicz 10y ago
    Do they get info about from which page they got requested when one includes just an image?
    - uiri 10y ago
      Yes, it is passed along through the Referer (sic) header.
    - daxelrod 10y ago
      Yes, via the HTTP Referer header.
  - fulldecent 10y ago
    Just FYI, I use the uBlock Origin extension for Chrome and I believe it solves all this for me.
- cynwoody 10y ago
  I just tried it using Chrome 57: var i = document.createElement('img'); i.src= "https://news.ycombinator.com/y18.gif"; document.body.insertBefore(i, document.body.firstChild); The image appeared in the upper left of the Google home page. So, I clicked over to the Network tab and viewed the headers. The request headers do not include any cookies. If Hacker News were a broker using GET requests to buy shares, and the image URL was such a request, HN would not have known whose account to buy the shares for, even though I'm logged in in another tab. So, presumably, the hack does not work in Chrome 57. Edit: Never mind. It's because I have third-party cookies blocked. If I unblock third-party cookies, my HN cookie does get sent.
- deleted 10y ago
  [deleted]
- Pxtl 10y ago
  Imho this is a complete misfeature of the web. It facilitates invasive tracking in exchange for very marginal utility.
idbehold 10y ago
Cookies are still sent for requests in which the response is opaque to the current document/window (e.g. <img>, <video>, <audio>, <script>, etc). There's no way for the document/window containing these elements to ever access the actual bytes returned by them.
captn3m0 10y ago
This is still true in 2017, unless a website is using same site cookies, which is a very recent thing. (The first draft is from 2015 April)
borplk 10y ago
That's how the web works today as well. That's why you need CSRF protection.
driverdan 10y ago
Because most people don't have 3rd party cookies disabled. It's one of the first things you should do when you install a browser. It doesn't break anything worthwhile and protects your privacy (and security).

Images are loaded with the cookies of their own site. Example: go to google.com, then open the console and type the following: var i = document.createElement('img'); i.src= "http://news.ycombinator.com/y18.gif"; http://news.ycombinator.com/y18.gif"; Then look at the cookies sent over the network.

shiv86 10y ago
Where do I type it ?
- jwilk 10y ago
  In Firefox, Ctrl+Shift+K opens the web console.
- shif 10y ago
  Ctrl + Shift + J in chrome
artursapek 10y ago
This is how FB & others track everyone on the web through ad frames, like buttons, etc.
- hoschicz 10y ago
  Do they get info about from which page they got requested when one includes just an image?
  - uiri 10y ago
    Yes, it is passed along through the Referer (sic) header.
  - daxelrod 10y ago
    Yes, via the HTTP Referer header.
- fulldecent 10y ago
  Just FYI, I use the uBlock Origin extension for Chrome and I believe it solves all this for me.
cynwoody 10y ago
I just tried it using Chrome 57: var i = document.createElement('img'); i.src= "https://news.ycombinator.com/y18.gif"; document.body.insertBefore(i, document.body.firstChild); The image appeared in the upper left of the Google home page. So, I clicked over to the Network tab and viewed the headers. The request headers do not include any cookies. If Hacker News were a broker using GET requests to buy shares, and the image URL was such a request, HN would not have known whose account to buy the shares for, even though I'm logged in in another tab. So, presumably, the hack does not work in Chrome 57. Edit: Never mind. It's because I have third-party cookies blocked. If I unblock third-party cookies, my HN cookie does get sent.
deleted 10y ago
[deleted]
Pxtl 10y ago
Imho this is a complete misfeature of the web. It facilitates invasive tracking in exchange for very marginal utility.

idbehold 10y ago

Cookies are still sent for requests in which the response is opaque to the current document/window (e.g. <img>, <video>, <audio>, <script>, etc). There's no way for the document/window containing these elements to ever access the actual bytes returned by them.

captn3m0 10y ago

This is still true in 2017, unless a website is using same site cookies, which is a very recent thing. (The first draft is from 2015 April)

borplk 10y ago

That's how the web works today as well. That's why you need CSRF protection.

driverdan 10y ago

Because most people don't have 3rd party cookies disabled. It's one of the first things you should do when you install a browser. It doesn't break anything worthwhile and protects your privacy (and security).