4 ms·
There are several data-broker-esque "services" that actually do this already with FB, Google, etc assets (favicon.ico and similar, loggedIn urls, ...) to check
by ev1 6y ago
There are several data-broker-esque "services" that actually do this already with FB, Google, etc assets (favicon.ico and similar, loggedIn urls, ...) to check whether you have visited those pages, or whether you are logged in to those services by trying to request a URL that might return a large image if logged in, or fail rapidly if logged out. -- This has been a thing for a long time: https://news.ycombinator.com/item?id=15499917 https://news.ycombinator.com/item?id=15499917
If you don't use any of those sites, you're considered higher risk/fraudulent user/bot.
Here's an example of a very short and easy way to see if someone is probably gay: https://pastebin.com/raw/CFaTet0K https://pastebin.com/raw/CFaTet0K
On chrome, I consistently get 1-5 back after it's been cached, and 100+ on a clean visit. On Firefox with resistFingerprinting, I get 0 always.
- amelius 6y agoThank you, that was insightful. > Here's an example of a very short and easy way to see if someone is probably gay Ok, but now the resource is in my cache, so from now on they will think I'm gay?
- tzot 6y agoYou could have run this on a private window of the browser (and in that case, they would surely think you're a closeted gay).
- ev1 6y ago> Ok, but now the resource is in my cache, so from now on they will think I'm gay? This resource is just generic, so probably not, but if you actually visited grindr's site without adblocking heavily, they load googletagmanager and a significant number of other tracking services, which will almost certainly associate your advertising profile and identifiers as 'gay' I also can't believe they send/sell your information to 3 pages worth of third party monetization providers/adtech companies for something that is this critically sensitive.
- 14u2c 6y agoCould this not be solved by by Grindr setting up CORS properly for that resource? It's unlikely anyone would ever open the script directly in their browser.
- srtjstjsj 6y agoFun fact: browsers put scary warnings in their dev console (and some web sites log warnings or console) because some people love copy-pasting code they got from sketchy people trying to bypass all the browser security.
- thefreeman 6y agoCORS wouldn't help here. CORS prevents you from reading the response or making a cross origin XHR requests, not loading an external resource from a different domain in a script or img tag.
- deleted 6y ago[deleted]