4 ms·

So to reveal someone's IP address do I just send a DM with URL to my server and log connections? Is it that easy? No clicking needed?

by megous 6y ago

AstralStorm 6y ago
It also bypasses browser preloading settings and messes with people who have limited bandwidth or transfer quota. It should be optional.
- megous 6y ago
  Yeah, I'm currently looking for a way to disable this and it seems like it may be controlled by: network.predictor.preconnect-min-confidence in Firefox.
  - Deukhoofd 6y ago
    Looking at caniuse.com preconnect hasn't been supported by Firefox since v71. I assume for this very reason. https://caniuse.com/link-rel-preconnect https://caniuse.com/link-rel-preconnect
  - Jestar342 6y ago
    "network.predictor.enabled" is there. Defaults is still "true".
  - youngtaff 6y ago
    Suspect that's not for explicit `<link rel=preconnect` More likely it's for when FF is making a connection because it predicts that page is going to use a connection to another origin
- judge2020 6y ago
  It just connects to the domain without making a request to it, so how does it use even a remotely noticeable amount of bandwidth?
  - megous 6y ago
    To answer that question: https://megous.com/dl/tmp/5a6729bcaa62d382.png https://megous.com/dl/tmp/5a6729bcaa62d382.png From wireshark capture of `openssl s_client localhost:443` 2kb can add up if done often enough. And this is a fairly ideal case. I just have two simple certs using secp384r1. If certificate chain is longer and when the certs use RSA, it will consume more bandwidth.
ShamelessC 6y ago
Indeed it is. I believe /var/log/nginx/access.log is where you'll find the info for an nginx server.
- megous 6y ago
  nginx will only log actual http requests there, but you can use error_log /path debug; to log connection attempts without any http content.
  - ShamelessC 6y ago
    Ah, I see. Thanks.
chinathrow 6y ago
I think at least a link hover is required. "Technically, it only preconnects when you hover over the link."
- megous 6y ago
  Due to browser design, one might be tempted to hover links to see their content (small popup in the bottom left corner), before clicking. Kind of a habit for me.
  - pferde 6y ago
    Yes, a feature that originally was helping security (allowing you to "look before you step"), has been hijacked to actually harm security and/or privacy. Makes one laugh, bitterly.
- rozab 6y ago
  Is there much of a downside to just disabling all hover events in the browser? I've also considered disabling the clipboard API after hearing about clipboard hijacking attacks recently
  - saagarjha 6y ago
    Some websites provide useful information on hover, including Twitter. Reading the bio of someone without leaving the page is convenient.
    - j-james 6y ago
      Perhaps an even better example is Wikipedia's article previews - enormously helpful when reading through a long or technical section.
- d2wa 6y ago
  You hover ever link as you scroll down the feed, though. Each link is the width of the feed, so it's hard to avoid.
dtech 6y ago
You'd need to use a unique domain for it though. That might be why they don't add the subdomain, because adding a unique subdomain to track a user. is free and a domain isn't.
- Lex-2008 6y ago
  you mean, they don't know about freenom.com, where one can register free .tk/.ml/.ga/.cf/.gq domains?
  - jaywalk 6y ago
    I didn't know about that until just now. Thanks!
- megous 6y ago
  Right, I wonder if using IPv6 link would be enough. It would have a lot of space for differentiating the user, and they may not do much pre-processing on it...
- lgats 6y ago
  in the case of software.codidact.com, they seem to have included the subdomain https://twitter.com/CodidactQA/status/1321237358776373248 https://twitter.com/CodidactQA/status/1321237358776373248 https://i.imgur.com/cdh8rKZ.png https://i.imgur.com/cdh8rKZ.png edit: prepending software.* to a domain prevents the subdomain from being removed, https://twitter.com/lukerehmann/status/1321310972468973568 https://twitter.com/lukerehmann/status/1321310972468973568 I've also tried messaging this same format of unique link and the preconnect slides right into the DMs
cm2187 6y ago
I guess you might also overload a server if someone popular links something.
lgats 6y ago
Is there any easy way to monitor preconnect / dns prefetch and others [in chrome / firefox] ?
- d2wa 6y ago
  WebKit-based browsers (e.g. Safari, Epiphany) will show a console message. That's it.

So to reveal someone's IP address do I just send a DM with URL to my server and log connections? Is it that easy? No clicking needed?

by megous 6y ago

So to reveal someone's IP address do I just send a DM with URL to my server and log connections? Is it that easy? No clicking needed?

AstralStorm 6y ago

It also bypasses browser preloading settings and messes with people who have limited bandwidth or transfer quota. It should be optional.

megous 6y ago
Yeah, I'm currently looking for a way to disable this and it seems like it may be controlled by: network.predictor.preconnect-min-confidence in Firefox.
- Deukhoofd 6y ago
  Looking at caniuse.com preconnect hasn't been supported by Firefox since v71. I assume for this very reason. https://caniuse.com/link-rel-preconnect https://caniuse.com/link-rel-preconnect
- Jestar342 6y ago
  "network.predictor.enabled" is there. Defaults is still "true".
- youngtaff 6y ago
  Suspect that's not for explicit `<link rel=preconnect` More likely it's for when FF is making a connection because it predicts that page is going to use a connection to another origin
judge2020 6y ago
It just connects to the domain without making a request to it, so how does it use even a remotely noticeable amount of bandwidth?
- megous 6y ago
  To answer that question: https://megous.com/dl/tmp/5a6729bcaa62d382.png https://megous.com/dl/tmp/5a6729bcaa62d382.png From wireshark capture of `openssl s_client localhost:443` 2kb can add up if done often enough. And this is a fairly ideal case. I just have two simple certs using secp384r1. If certificate chain is longer and when the certs use RSA, it will consume more bandwidth.

ShamelessC 6y ago

Indeed it is. I believe /var/log/nginx/access.log is where you'll find the info for an nginx server.

megous 6y ago
nginx will only log actual http requests there, but you can use error_log /path debug; to log connection attempts without any http content.
- ShamelessC 6y ago
  Ah, I see. Thanks.

chinathrow 6y ago

I think at least a link hover is required. "Technically, it only preconnects when you hover over the link."

megous 6y ago
Due to browser design, one might be tempted to hover links to see their content (small popup in the bottom left corner), before clicking. Kind of a habit for me.
- pferde 6y ago
  Yes, a feature that originally was helping security (allowing you to "look before you step"), has been hijacked to actually harm security and/or privacy. Makes one laugh, bitterly.
rozab 6y ago
Is there much of a downside to just disabling all hover events in the browser? I've also considered disabling the clipboard API after hearing about clipboard hijacking attacks recently
- saagarjha 6y ago
  Some websites provide useful information on hover, including Twitter. Reading the bio of someone without leaving the page is convenient.
  - j-james 6y ago
    Perhaps an even better example is Wikipedia's article previews - enormously helpful when reading through a long or technical section.
d2wa 6y ago
You hover ever link as you scroll down the feed, though. Each link is the width of the feed, so it's hard to avoid.

dtech 6y ago

You'd need to use a unique domain for it though. That might be why they don't add the subdomain, because adding a unique subdomain to track a user. is free and a domain isn't.

Lex-2008 6y ago
you mean, they don't know about freenom.com, where one can register free .tk/.ml/.ga/.cf/.gq domains?
- jaywalk 6y ago
  I didn't know about that until just now. Thanks!
megous 6y ago
Right, I wonder if using IPv6 link would be enough. It would have a lot of space for differentiating the user, and they may not do much pre-processing on it...
lgats 6y ago
in the case of software.codidact.com, they seem to have included the subdomain https://twitter.com/CodidactQA/status/1321237358776373248 https://twitter.com/CodidactQA/status/1321237358776373248 https://i.imgur.com/cdh8rKZ.png https://i.imgur.com/cdh8rKZ.png edit: prepending software.* to a domain prevents the subdomain from being removed, https://twitter.com/lukerehmann/status/1321310972468973568 https://twitter.com/lukerehmann/status/1321310972468973568 I've also tried messaging this same format of unique link and the preconnect slides right into the DMs

cm2187 6y ago

I guess you might also overload a server if someone popular links something.

lgats 6y ago

Is there any easy way to monitor preconnect / dns prefetch and others [in chrome / firefox] ?

d2wa 6y ago
WebKit-based browsers (e.g. Safari, Epiphany) will show a console message. That's it.