Note: This post now archived and as such no longer works

An external image showing your user-agent and the total "hit count"

  • andscape
    link
    fedilink
    English
    arrow-up
    7
    ·
    1 year ago

    Can countermeasures be implemented in the clients to mitigate privacy risks, while not having to proxy images?

    • flathead@quex.cc
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      no. the remote server will log the requests based on the client address. it is a good argument for using a vpn.

      • andscape
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        1 year ago

        Oh I mean, sure, but I don’t think IP logging is the main privacy concern with spy pixels.

        I’m assuming this trick uses the user agent string and other request metadata to identify clients. Even if it didn’t recognize Jerboa as a client, it did guess that I was on mobile. That’s not possible just by tracking IPs, unless they’re cross-referencing it with other datasets. Also, I was on VPN anyway, so the IP would have been useless.

        It should be possible for clients to obfuscate/fake the metadata of image requests to make tracking with spy pixels less effective.

    • psud@aussie.zone
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      At it’s basic level it will capture your IP address, but it won’t really tie the IP to a user name, and there’s not a role lot you can do with it

      Attacks I can think of:

      • target advertising at users in a particular lemmy community
      • get a collection of IP addresses of people with specific problems or beliefs (indicated by membership in a lemmy community) to target with malware

      A VPN would protect you in this case, but you need to be a bit of a privacy nut to also protect yourself from things that identify for advertising right now

      • TriLinder@lemmy.mlOP
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        1 year ago

        If you wanted to target a specific user, you could always send a DM with the image

        • psud@aussie.zone
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          You could also correlate time of your log entry to order of comments sorted by new, with errors from the few clients that don’t load images