Hacker News Reader

Comment by Pxtl | Hacker News Reader

FYI, it's very NSFW in the back-end. Your browser is sending requests to obvious porn servers when you hit this link so it can test if you're logged in to them.

View on HN

A more SFW version (took out YouPorn):

http://codepen.io/anon/pen/ALdqox/right/

This version connects to squareup.com, twitter.com, www.facebook.com, accounts.google.com, accounts.google.com, plus.google.com, login.skype.com, www.flickr.com, www.spotify.com, www.reddit.com, www.tumblr.com, www.expedia.de, www.dropbox.com, www.amazon.com, www.pinterest.com, www.netflix.com, de.foursquare.com, eu.battle.net, store.steampowered.com, www.academia.edu, stackoverflow.com, accounts.google.com, github.com, medium.com, news.ycombinator.com, carbonmade.com, courses.edx.org, www.spiegel.de, slack.com, www.khanacademy.org, www.paypal.com

This one actually works for me! The other said that I was using Privacy Badger since it couldn't detect anything. I'm not, but I am using uBlock Origin. This one is only wrong about a couple (it doesn't register, for example, that I am logged in to G+, Khan Academy, Steam, Amazon, PayPal, or Skype).

You can actually have privacy badger black all of this if you play around with the settings.

I mean I think its too much to ask for a tool to be able to block everything right without a little human assistance.

Doesn't uBlock have a filter specifically for privacy (off by default I believe).

I actually had several of the extra filters enabled already, but only once I added "Fanboy's Enhanced Tracking List"[0] did uBlock Origin successfully block this technique. I'm not sure whether any of the other filters would accomplish the same result.

After enabling this filter, 0942v8653's version also failed.

[0] https://www.fanboy.co.nz/enhancedstats.txt

It has several you can choose from in fact, can be enabled in the options pane.

Thanks for the SFW version. Nice to see that uMatrix is doing it's job quite well and as expected.

FWIW, Spotify doesn't seem to get recognized properly. I am definitely logged in and it should show up when all my browser protections are disabled. HN showed up when I disabled everything, but not Spoitfy.

Yeah, that would've been nice to know ahead of time. Why not, for example, trigger the test when someone clicks a button, rather than taking someone's page visit as permission to try lighting up their organization's content filter?

I think it helps in conveying the fact that it is a vulnerability not a feature.

So any website (even your own company's internal one) can check stuff like this. And you can't do anything about it. Other than always using private browsing for anything you don't want your company/anyone else to know about.

I mean, if somebody is logged into YouPorn from work, that's not a problem I expect the developer of a tool like this to solve. What I expect the developer of a tool like this to do is not create problems by just arbitrarily making HTTP requests to porn sites without a prompt or a chance to opt out. That's a dick move.

When I first read that it was making these requests here in the comments, my reaction was similar. But then upon reflection, I don't think there's a problem for the author here. Why? Because all I did was click the link. Meaning if I was behind a corporate firewall or the like, this sort of thing could be happening all the time and unless I was always tracing requests in my browser or via MITM or logging DNS, I'd have no way of knowing.

Personally I view this as a browser and/or protocol issue (the kind that has trickled down from the origins of the web) and really can't fault the author for it. In fact I think it's appropriate the author left these requests in as it reflects an actual attack scenario better perhaps.

The point I'm making is that it's not necessary to hit a porn site in order to get the point across, and there are HN users whose organizations observe and don't care for that kind of thing.

Then how can such organizations handle other people randomly putting references to porn sites on their websites? With today's Internet being what it is, you can't assume that a request to YouPorn means someone is browsing porn at work. For all you know, the request could have been sent by an ad.

Then again, businesses in general aren't exactly paragons of intelligence either, so I wouldn't be surprised if someone made a fuss about it...

Absolutely!... If your company is doing web filtering, it will report an attempted hit from your browser to the YP site.

Yet another inequality to throw in the hopper

In bird culture, this is considered a dick move.

I believe using private browsing wouldn't matter. The IP I'm browsing from is still going to try pinging all those porn servers, and that's what's getting logged in the filter, not my browser history.

In my second paragraph, I was actually talking about your company sending such requests to know what you are logged into. Doesn't matter if you're using it right now. If you're logged in from days before, your cookies will be there. In incognito they won't be.

Privacy Badger will stop that tool if you edit the settings.

What a surprising problem. If the boss mistakenly accuses you of watching porn - why not explain why they're wrong and show them the site? If they won't accept that, then it means you're in danger with any web surfing you do at work and should already not be clicking random links. It's not the site's fault, it's your company's fault and your own for not protecting yourself against breaking their rules.

Personally, the idea that there's a network my traffic flows over, where that traffic is sniffed such that its content could potentially result in things like me losing my job, is just debilitating to me.

If I worked for such a company, all my traffic would be flowing over a VPN, full-stop.

> If I worked for such a company, all my traffic would be flowing over a VPN, full-stop.

When you work for such a company, all VPNs are blocked and prohibited, full-stop.

Source: worked for such a company

Pretty standard in any reasonably secure financial services org.

All direct Internet access is blocked and prohibited, with all attempts to access the Internet (tcp/80, tcp/443) transparently proxied via Bluecoat/Websense/Forcepoint/etc proxies, which filter based on URL categorisation. WSS generally doesn't work in this kind of environment. Everything else is dropped.

Any attempts to bypass filtering is a violation of IT policy and is sackable. Visiting sites that are blocked gets logged, doesn't generally get flagged up unless is a daily occurrence, and the first assumption is usually malware.

Source: Worked for several such companies, was responsible for perimeter security in some.

Tried it and... imagine my disappointment to find out it's ONLY connecting to youporn.

"very NSFW" and "serverS" were overstatements.

This is definitely NSFW if your workplace monitors the domains you connect to.

The monitoring must have funny statistics with all the ads going to <explicitdomain>.com

I figured "warn first, confirm the details later".

Corporate IT admins, care to comment here? If you see a single connection to youporn, do alarm bells go off?

Yes, we initiate protocol zero once the sirens sound off.

IT team then calls in air support

Yes, and then we bring out the fire hoses

No one is actually watching.

I removed the request to Youporn. Sorry if it caused any trouble.

Well, that was not very nice. Should have asked confirmation. I clicked on the link thinking there would be an explanation of what this project does.

Reply on news.ycombinator.com