News for hackers. Stuff that matters.

A comment on Show HN: What every browser knows about you. Parent comment

Re:Show HN: What every browser knows about you by eatsfoobars on Sunday April 03, 2016 @05:02AM (#11415462)
The login page will redirect to the favicon if the user is already logged in, or it will serve a regular HTML page if the user is not.

So, the script creates an (invisible) <img> element for every website which points to the login page (which might redirect to the favicon). If it receives an image, the user is already logged in and the onLoad() callback will fire. Otherwise, it will get an HTML page, so the onError() callback will fire.

It could work with any image on the website, not just the favicon.

[ Parent | on HN ]
Re:Show HN: What every browser knows about you by Capira on Sunday April 03, 2016 @05:23PM (#11417818)
Though the redirect works only with images hosted on the same domain. The favicon was the only image I could find on twitter.com or facebook.com.

I reported this bug to every company listed there, but all of them said it is not relevant to their users' privacy.

[ Parent | on HN ]
Re:Show HN: What every browser knows about you by hm8 on Wednesday April 06, 2016 @03:43AM (#11437278)
Yeah, that's a very critical information. Thanks, guys!
[ Parent | on HN ]
Re:Show HN: What every browser knows about you by dserodio on Monday April 11, 2016 @05:40PM (#11475357)
This is showing that I'm logged in to Facebook but I don't have an account there anymore.
[ Parent | on HN ]