5 ms·

Images are loaded with the cookies of their own site. Example: go to google.com, then open the console and type the following: var i = document.createElement(

Images are loaded with the cookies of their own site. Example: go to google.com, then open the console and type the following: var i = document.createElement('img'); i.src= "http://news.ycombinator.com/y18.gif"; http://news.ycombinator.com/y18.gif"; Then look at the cookies sent over the network.

shiv86 10y ago
Where do I type it ?
- jwilk 10y ago
  In Firefox, Ctrl+Shift+K opens the web console.
- shif 10y ago
  Ctrl + Shift + J in chrome
artursapek 10y ago
This is how FB & others track everyone on the web through ad frames, like buttons, etc.
- hoschicz 10y ago
  Do they get info about from which page they got requested when one includes just an image?
  - uiri 10y ago
    Yes, it is passed along through the Referer (sic) header.
  - daxelrod 10y ago
    Yes, via the HTTP Referer header.
- fulldecent 10y ago
  Just FYI, I use the uBlock Origin extension for Chrome and I believe it solves all this for me.
cynwoody 10y ago
I just tried it using Chrome 57: var i = document.createElement('img'); i.src= "https://news.ycombinator.com/y18.gif"; document.body.insertBefore(i, document.body.firstChild); The image appeared in the upper left of the Google home page. So, I clicked over to the Network tab and viewed the headers. The request headers do not include any cookies. If Hacker News were a broker using GET requests to buy shares, and the image URL was such a request, HN would not have known whose account to buy the shares for, even though I'm logged in in another tab. So, presumably, the hack does not work in Chrome 57. Edit: Never mind. It's because I have third-party cookies blocked. If I unblock third-party cookies, my HN cookie does get sent.
deleted 10y ago
[deleted]
Pxtl 10y ago
Imho this is a complete misfeature of the web. It facilitates invasive tracking in exchange for very marginal utility.