Just dodged a tracker pixel (I think) -- thanks to a text-based mail client and Tor
Just dodged a tracker pixel (I think) -- thanks to a text-based mail client and Tor
Tracker pixels are surprisingly commonly used by legitimate senders.. your bank, your insurance company, any company you patronize. These assholes hide a 1-pixel image in HTML that tracks when you open your email and your IP (thus whereabouts).
I use a text-based mail client in part for this reason. But I got sloppy and opened an HTML attachment in a GUI browser without first inspecting the HTML. I inspected the code afterwards. Fuck me, I thought.. a tracker pixel. Then I visited just the hostname in my browser. Got a 403 Forbidden. I was happy to see that.
Can I assume these idiots shot themselves in the foot with a firewall Tor blanket block? Or would the anti-tor firewall be smart enough to make an exception for tracker pixel URLs?
403 means you still hit their server, and it could well have been logged.
Indeed, but what what was logged? Suppose the tracker pixel is something like:
https://www.website.com/uniqueDirForTracking/b1946ac92492d2347c6235b4d2611184.gifand I visit that URL from Tor. The server at
www.website.comcan easily log the (useless) Tor IP and timestamp, but does it log theb1946ac92492d2347c6235b4d2611184? I’m not an expert on this which is why I am asking, but with my rough understanding I suspect that transaction might break down to multiple steps:- a TLS negotiation just with the
www.website.comhost - if successful, a session cookie may or may not be sent.
- the “document” (“image”) is fetched by an HTTPGET req (using the cookie, if given).
If the negotiation is blocked by the firewall, does the server ever even see the request for
b1946ac92492d2347c6235b4d2611184.gif?- a TLS negotiation just with the
As long as your graphical email client has the loading of remote images turned off, the tracking pixel won’t be visited.
Most/Many email software has this be default or can be enabled: Thunderbird, iOS Mail, FastMail app and website, etc.
Text-based email is cool though. My college had us using Pine back in the day.
I suppose you could even say text-based clients are at a disadvantage because when we opt to render the HTML graphically, a full-blown browser is launched which is likely less hardened than something like whatever profile and engine Thunderbird embeds.
In my case I created a firejailed browser with
--net=noneso I could hit a certain key binding to launch the neutered browser to render an HTML attachment in a forced-offline context--- but I was too fucking lazy to dig up what keys I bound to that which is why I (almost?) got burnt.