Tracker pixels are surprisingly commonly used by legitimate senders… your bank, your insurance company, any company you patronize. These assholes hide a 1-pixel image in HTML that tracks when you open your email and your IP (thus whereabouts).

I use a text-based mail client in part for this reason. But I got sloppy and opened an HTML attachment in a GUI browser without first inspecting the HTML. I inspected the code afterwards. Fuck me, I thought… a tracker pixel. Then I visited just the hostname in my browser. Got a 403 Forbidden. I was happy to see that.

Can I assume these idiots shot themselves in the foot with a firewall Tor blanket block? Or would the anti-tor firewall be smart enough to make an exception for tracker pixel URLs?

  • evenwicht@lemmy.sdf.orgOPM
    3·
    2 days ago

    Indeed, but what what was logged? Suppose the tracker pixel is something like:

    https://www.website.com/uniqueDirForTracking/b1946ac92492d2347c6235b4d2611184.gif

    and I visit that URL from Tor. The server at www.website.com can easily log the (useless) Tor IP and timestamp, but does it log the b1946ac92492d2347c6235b4d2611184? I’m not an expert on this which is why I am asking, but with my rough understanding I suspect that transaction might break down to multiple steps:

    1. a TLS negotiation just with the www.website.com host
    2. if successful, a session cookie may or may not be sent.
    3. the “document” (“image”) is fetched by an HTTPGET req (using the cookie, if given).

    If the negotiation is blocked by the firewall, does the server ever even see the request for b1946ac92492d2347c6235b4d2611184.gif?

    • CameronDev
      4·
      2 days ago

      Yes, the server gets the request for /uniqueForTracking/b19...184.gif, which could be logged.

      • evenwicht@lemmy.sdf.orgOPM
        2·
        2 days ago

        That’s interesting. It sounds like browsers could be designed smarter. I get “403 Forbidden” chronically in the normal course of web browsing. In principle if a server is going to refuse to serve me, then I want to give the server as little as possible. Shouldn’t Tor browser attempt to reach the landing page of the host first just to check the headers for a 403, then if no 403 proceed to the full URL?

        #dataMinimization

        • CameronDev
          4·
          2 days ago

          Its not a browser thing, its HTTP. The return codes are specific to the request, not the server.

          GET example.com could validly return 403, while GET example.com/tracking123.gif returns 200 or anything else.

    • TheSlad@sh.itjust.works
      1·
      2 days ago

      It knows when you looked at the tracker pixel, and that youre using tor. Also knows your tor exit node, but thats probably not useful to them.