7 ms·

Next step (please): block all 1x1 sized images. The transparent pixel tracking trick is common enough now that it should be blocked by default in all 'Private'

Next step (please): block all 1x1 sized images. The transparent pixel tracking trick is common enough now that it should be blocked by default in all 'Private' modes.

metalliqaz 6y ago
... and tracking pixels would become 1x2, meanwhile actual 1x1 images used for formatting would stop working
- falcolas 6y ago
  > 1x1 images for formatting Huh? People still do this? Designers, I swear.
  - hjek 6y ago
    That is how indentation is implemented on HN!
    - maddyboo 6y ago
      Wow, you're not kidding! https://i.imgur.com/5dg068V.png https://i.imgur.com/5dg068V.png
      - deleted 6y ago
        [deleted]
    - nvr219 6y ago
      Awesome
- FalconSensei 6y ago
  > actual 1x1 images used for formatting would stop working I see that as a feature
asicsp 6y ago
Not sure if it is the default setting on Firefox, but they show up as something like 'tracking image' for me.
MozNoz 6y ago
https://blog.mozilla.org/security/2021/01/26/supercookie-protections/ https://blog.mozilla.org/security/2021/01/26/supercookie-pro... partitions the image cache by the site being visited.
- ape4 6y ago
  Yes the origin of tiny images is more important (and is dealt with now)
jasode 6y ago
>Next step (please): block all 1x1 sized images. If you're not aware, the HTTP protocol specification[1] doesn't have a technical way of knowing ahead of time if it's a 1x1 tracking pixel. So the remaining realistic options are: (1) block ALL <img> tags downloads which then blocks any 1x1 tracking pixels (2) allow <img> tags but block some (and maybe most but not all) 1x1 pixels via a blacklist of url domains (e.g. doubleclick.net) ... and/or heuristics based on the "style" attribute The (1) already happens in many email clients that render HTML. The (2) is happening with the ongoing cat & mouse game with AdBlock, EasyList, etc [1] https://www.google.com/search?q=http+protocol+request+get+syntax https://www.google.com/search?q=http+protocol+request+get+sy...
- eli 6y ago
  (1) happens in relatively few email clients. Every major client loads images by default except Thunderbird and it is not common.
  - throwaway120820 6y ago
    ...and Outlook
    - eli 6y ago
      Nope, Outlook definitely loads images unless you or your administrator changed the setting.
      - nvr219 6y ago
        This is simply not true. Out of the box Outlook install does not display images for senders not marked safe, nor does Outlook Web App.
      - jasode 6y ago
        >Outlook definitely loads images unless you or your administrator changed the setting. I just installed a fresh copy of Office 2019 in a vm and Outlook's default setting doesn't load images. This block-downloading-images-default behavior matches what I read here: https://support.microsoft.com/en-us/office/block-or-unblock-automatic-picture-downloads-in-email-messages-15e08854-6808-49b1-9a0a-50b81f2d617a https://support.microsoft.com/en-us/office/block-or-unblock-...
kgwxd 6y ago
Is that something used on web sites? I've only heard of that in emails. What purpose would that server to a site you're already visiting?
- newscracker 6y ago
  It’s just another way to do third party tracking, and could be loaded from a third party site.
- Macha 6y ago
  The images are on other domains used by advertiser or adtech company tracking, not for the website actually showing the ads.
- twobitshifter 6y ago
  Look into Facebook pixel. Your browser is hitting this almost everywhere. https://blog.hootsuite.com/facebook-pixel/ https://blog.hootsuite.com/facebook-pixel/
  - GoblinSlayer 6y ago
    And it's the only realistically working pixel. Others aren't as pervasive.
- amalcon 6y ago
  Concrete-ish but still simple simple version: If you visit example.com, close the tab, and then load a page with an ad on it, both parties would love to show you an ad for whatever example.com is selling. If example.com has a tracking pixel for the ad domain, then this is trivial to make happen.
  - bserge 6y ago
    OK, I understand privacy concerns with actually private information like name/address/email/etc. But a tracking pixel for ads? Why is this a concern? Since when? Would it be so bad if people actually worked their brains a bit and got smarter with online advertising (and lots of other stuff)? This looks suspiciously like the situation with obesity. Instead of eating less to lose weight, and eating fresh to stay healthy, people just blame "the corporations" for all their troubles. Seems to me like it's counterproductive. Just put up safety nets for people because they can't control themselves. What do you end up with? A bunch of impulsive idiots and a few organizations with way too much control over them. This is reality as I see it. You can be offended if you want, but I'd suggest you learn not to be offended by some words on a screen. That of course requires responsibility, which is free but I can sell it to you for $99/month if you want.

Next step (please): block all 1x1 sized images. The transparent pixel tracking trick is common enough now that it should be blocked by default in all 'Private' modes.

metalliqaz 6y ago

... and tracking pixels would become 1x2, meanwhile actual 1x1 images used for formatting would stop working

falcolas 6y ago
> 1x1 images for formatting Huh? People still do this? Designers, I swear.
- hjek 6y ago
  That is how indentation is implemented on HN!
  - maddyboo 6y ago
    Wow, you're not kidding! https://i.imgur.com/5dg068V.png https://i.imgur.com/5dg068V.png
    - deleted 6y ago
      [deleted]
  - nvr219 6y ago
    Awesome
FalconSensei 6y ago
> actual 1x1 images used for formatting would stop working I see that as a feature

asicsp 6y ago

Not sure if it is the default setting on Firefox, but they show up as something like 'tracking image' for me.

MozNoz 6y ago

https://blog.mozilla.org/security/2021/01/26/supercookie-protections/ https://blog.mozilla.org/security/2021/01/26/supercookie-pro... partitions the image cache by the site being visited.

ape4 6y ago
Yes the origin of tiny images is more important (and is dealt with now)

jasode 6y ago

>Next step (please): block all 1x1 sized images. If you're not aware, the HTTP protocol specification[1] doesn't have a technical way of knowing ahead of time if it's a 1x1 tracking pixel. So the remaining realistic options are: (1) block ALL <img> tags downloads which then blocks any 1x1 tracking pixels (2) allow <img> tags but block some (and maybe most but not all) 1x1 pixels via a blacklist of url domains (e.g. doubleclick.net) ... and/or heuristics based on the "style" attribute The (1) already happens in many email clients that render HTML. The (2) is happening with the ongoing cat & mouse game with AdBlock, EasyList, etc [1] https://www.google.com/search?q=http+protocol+request+get+syntax https://www.google.com/search?q=http+protocol+request+get+sy...

eli 6y ago
(1) happens in relatively few email clients. Every major client loads images by default except Thunderbird and it is not common.
- throwaway120820 6y ago
  ...and Outlook
  - eli 6y ago
    Nope, Outlook definitely loads images unless you or your administrator changed the setting.
    - nvr219 6y ago
      This is simply not true. Out of the box Outlook install does not display images for senders not marked safe, nor does Outlook Web App.
    - jasode 6y ago
      >Outlook definitely loads images unless you or your administrator changed the setting. I just installed a fresh copy of Office 2019 in a vm and Outlook's default setting doesn't load images. This block-downloading-images-default behavior matches what I read here: https://support.microsoft.com/en-us/office/block-or-unblock-automatic-picture-downloads-in-email-messages-15e08854-6808-49b1-9a0a-50b81f2d617a https://support.microsoft.com/en-us/office/block-or-unblock-...

kgwxd 6y ago

Is that something used on web sites? I've only heard of that in emails. What purpose would that server to a site you're already visiting?

newscracker 6y ago
It’s just another way to do third party tracking, and could be loaded from a third party site.
Macha 6y ago
The images are on other domains used by advertiser or adtech company tracking, not for the website actually showing the ads.
twobitshifter 6y ago
Look into Facebook pixel. Your browser is hitting this almost everywhere. https://blog.hootsuite.com/facebook-pixel/ https://blog.hootsuite.com/facebook-pixel/
- GoblinSlayer 6y ago
  And it's the only realistically working pixel. Others aren't as pervasive.
amalcon 6y ago
Concrete-ish but still simple simple version: If you visit example.com, close the tab, and then load a page with an ad on it, both parties would love to show you an ad for whatever example.com is selling. If example.com has a tracking pixel for the ad domain, then this is trivial to make happen.
- bserge 6y ago
  OK, I understand privacy concerns with actually private information like name/address/email/etc. But a tracking pixel for ads? Why is this a concern? Since when? Would it be so bad if people actually worked their brains a bit and got smarter with online advertising (and lots of other stuff)? This looks suspiciously like the situation with obesity. Instead of eating less to lose weight, and eating fresh to stay healthy, people just blame "the corporations" for all their troubles. Seems to me like it's counterproductive. Just put up safety nets for people because they can't control themselves. What do you end up with? A bunch of impulsive idiots and a few organizations with way too much control over them. This is reality as I see it. You can be offended if you want, but I'd suggest you learn not to be offended by some words on a screen. That of course requires responsibility, which is free but I can sell it to you for $99/month if you want.