Note: This post now archived and as such no longer works

An external image showing your user-agent and the total "hit count"

  • ono
    link
    fedilink
    English
    arrow-up
    23
    ·
    edit-2
    1 year ago

    Notably, this allows remote parties to associate your IP address with your interests, as revealed by the Lemmy communities that you browse.

    One way is for the image host to use the HTTP Referer field. (Standards-respecting web browsers pass the URL of the web page being viewed to the server hosting the image.)

    Another way is by posting an image with a unique URL.

    Even if Referer is withheld and the image is not unique, the image host can still do basic fingerprinting of your client’s request header and your OS’s TCP quirks, and associate that fingerprint with your IP address.

    An option for Lemmy to proxy media would be very helpful. Small instances could perhaps disable it, although they might not need to, since the additional load would scale with the number of users on that instance.

    • PoliticalAgitator@lemm.ee
      link
      fedilink
      arrow-up
      6
      ·
      edit-2
      1 year ago

      Notably, this allows remote parties to associate your IP address with your interests, as revealed by the Lemmy communities that you browse.

      I suspect with a coordinated pool of posts or multiple comments on the same post, you could narrow that IP address down to an actual user account.

      When a new comment is posted by a user, store, against their username, all IP addresses that visited since the last comment in that thread (by anyone). When a second comment is posted by a user, remove any IP addresses that don’t appear in both lists.

      I suspect you would have a very short list after two comments, and a single address after 3. It would also be extremely easy to both lure someone into viewing an image and bait them into multiple replies. Geolocate that IP and you know know vaguely where that user lives.

      Time to make sure you’re always on a VPN I guess.

      • TriLinder@lemmy.mlOP
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        You could also send the image through a DM if you want to find a particular user

      • ono
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        Even without that, once your Lemmy interests are sold/shared by IP address, they can be associated with your real identity as soon as you log in to a service that knows who you are.