4 ms·

Another interesting (and more practical) use of the favicon is visit duration tracking without JS: https://twitter.com/davywtf/status/951203191944773632 https:/

Another interesting (and more practical) use of the favicon is visit duration tracking without JS: https://twitter.com/davywtf/status/951203191944773632 https://twitter.com/davywtf/status/951203191944773632 Basically the favicon connection to the server stays open sending a periodic junk-update so that the server can detect when the tab is closed. You can do it with any asset but the favicon hides the loading indicator.

munk-a 8y ago
Sigh, it's neat yea - but advertisers are going to start leveraging favicon stay-alives for revenue gauging.
- wybiral 8y ago
  It's easier and common to do with JS, so it would be a really niche target. I was investigating it as a method of tracking users on Tor where JS is often disabled.
  - chipperyman573 8y ago
    While really novel and interesting, would it really work that well on Tor/etc? Most people using those browsers are pretty privacy conscious and I feel like people would notice a connection that never closes
    - wybiral 8y ago
      Tor can also create a false sense of privacy because people think it will do all of the work for them. If they look at the network tab in their browser they can see it, but it just looks like a favicon asset that's really slow to load. And people usually assume that with JS disabled these things don't happen. That's also the purpose of using it in the favicon. It prevents the loading spinner so you'd have to inspect the connections.
  - tinus_hn 8y ago
    You could also consider that people using TOR explicitly do not want to be tracked.
techntoke 8y ago
Why isn't stuff like this considered a security vulnerability in the browser and not require extra permissions from the user? I thought companies like Mozilla were supposed to be on the side of the users, but it often seems like they just make it easier and easier for companies to spy on users.
- wybiral 8y ago
  This particular cases is just an unintended consequence. They could put a limit on the connection duration, but you could also just slowly drip the bytes of a real favicon image (possibly augmented with junk metadata) and how would the browser know that it's not just a slow server connection?
  - techntoke 8y ago
    These are favicons we are talking about. There is no legitimate reason for the browser to enable and permit this type of tracking without some permission from the user.
    - wybiral 8y ago
      It's not really "permitting" it, that's just how the internet works. If you send the data slowly you can keep a connection open. And fighting privacy violation is basically a game of cat and mouse. As soon as we figure out how to block their tactics, they evolve. If what I'm doing here became mainstream they would probably do something about it, but as it stands this is much easier to do using JS or something anyway (which people know violates their privacy but they leave it enabled because modern websites break down without it).
    - zzo38computer 8y ago
      Anyways I disabled favicons on my computer from when I installed it, because that is not a feature I use. I did not know of this specific use before, but now I do.
    - wowMarijuana 8y ago
eridius 8y ago
Presumably you could do the same thing with a `<script async>` tag, drip-feeding bytes across the connection and waiting for it to close. Though now that I've said that, it occurs to me that disabling JavaScript almost certainly avoids loading script hrefs to begin with rather than just not executing them. Is there an equivalent with any other type of resource, that avoids deferring onLoad?
- wybiral 8y ago
  > Is there an equivalent with any other type of resource, that avoids deferring onLoad? If JS is disabled the event doesn't really matter and any asset can be handled this way. I just use the favicon because it stops the browser from showing a loading spinner so everything looks still and nobody assumes there's anything going on in the background. You can use persistent connections like this in other strange ways too. For instance this is a no-JS chat that's even able to update the connection count by sending a bit of CSS lazily: https://harmless.herokuapp.com/main https://harmless.herokuapp.com/main
bradleyhb 8y ago
I wonder if there was a proposal to make the time an equal split between GMT+

munk-a 8y ago

Sigh, it's neat yea - but advertisers are going to start leveraging favicon stay-alives for revenue gauging.

wybiral 8y ago
It's easier and common to do with JS, so it would be a really niche target. I was investigating it as a method of tracking users on Tor where JS is often disabled.
- chipperyman573 8y ago
  While really novel and interesting, would it really work that well on Tor/etc? Most people using those browsers are pretty privacy conscious and I feel like people would notice a connection that never closes
  - wybiral 8y ago
    Tor can also create a false sense of privacy because people think it will do all of the work for them. If they look at the network tab in their browser they can see it, but it just looks like a favicon asset that's really slow to load. And people usually assume that with JS disabled these things don't happen. That's also the purpose of using it in the favicon. It prevents the loading spinner so you'd have to inspect the connections.
- tinus_hn 8y ago
  You could also consider that people using TOR explicitly do not want to be tracked.

techntoke 8y ago

Why isn't stuff like this considered a security vulnerability in the browser and not require extra permissions from the user? I thought companies like Mozilla were supposed to be on the side of the users, but it often seems like they just make it easier and easier for companies to spy on users.

wybiral 8y ago
This particular cases is just an unintended consequence. They could put a limit on the connection duration, but you could also just slowly drip the bytes of a real favicon image (possibly augmented with junk metadata) and how would the browser know that it's not just a slow server connection?
- techntoke 8y ago
  These are favicons we are talking about. There is no legitimate reason for the browser to enable and permit this type of tracking without some permission from the user.
  - wybiral 8y ago
    It's not really "permitting" it, that's just how the internet works. If you send the data slowly you can keep a connection open. And fighting privacy violation is basically a game of cat and mouse. As soon as we figure out how to block their tactics, they evolve. If what I'm doing here became mainstream they would probably do something about it, but as it stands this is much easier to do using JS or something anyway (which people know violates their privacy but they leave it enabled because modern websites break down without it).
  - zzo38computer 8y ago
    Anyways I disabled favicons on my computer from when I installed it, because that is not a feature I use. I did not know of this specific use before, but now I do.
  - wowMarijuana 8y ago

eridius 8y ago

Presumably you could do the same thing with a `<script async>` tag, drip-feeding bytes across the connection and waiting for it to close. Though now that I've said that, it occurs to me that disabling JavaScript almost certainly avoids loading script hrefs to begin with rather than just not executing them. Is there an equivalent with any other type of resource, that avoids deferring onLoad?

wybiral 8y ago
> Is there an equivalent with any other type of resource, that avoids deferring onLoad? If JS is disabled the event doesn't really matter and any asset can be handled this way. I just use the favicon because it stops the browser from showing a loading spinner so everything looks still and nobody assumes there's anything going on in the background. You can use persistent connections like this in other strange ways too. For instance this is a no-JS chat that's even able to update the connection count by sending a bit of CSS lazily: https://harmless.herokuapp.com/main https://harmless.herokuapp.com/main

bradleyhb 8y ago

I wonder if there was a proposal to make the time an equal split between GMT+