Hacker News Reader

Hacker News

Comment by numair | Hacker News Reader

Full thread

numair

Buried in that article is this very fun and creepy link:

https://genesis.malwarebytes.com/api/v1/wai.gif

Not sure I would ever trust any privacy claims from a company that stores this type of made-for-fingerprinting data.

View on HN

Risky click disclosure: The GIF isn’t a GIF, it’s a JSON response containing full geo-location data on the requestor.

> Not sure I would ever trust any privacy claims from a company that stores this type of made-for-fingerprinting data.

Reminder that every resource you request from anywhere causes the server to be able to index all this info on you. Anyone doing anything where audience matters has a subscription to MaxMind GeoIP lookup, giving you all this info inline on every request. There is nothing special about this GIF except it shows you the info the server has.

If it bothers you, the idea of servers having all this info tying your requests together, you can switch on “Private Relay (Beta)” on MacOS and iOS, but note that the beta doesn’t play nice with a custom profile for DNS (it will look up once for filtering, and again for private relay).

There is a principle I live by, that most people used to live by before we entered this strange neo-savage era: “just because you can, doesn’t mean you should.” I expect the same from the companies with which I do business.

The only rational thing to expect from a company is to aim to be profitable, I suppose

In the MoviePass (and lesser so, WeWork) era, I'm not sure those are rational expectations anymore either.

This is a pretty nihilistic view of capitalism and I think we can aim to be better.

FWIW I know plenty companies that try to be a good company and not just a profitable one.

Did we? I believe Oppenheimer was overruled on Hiroshima.

Note that iCloud Private Relay only applies to Safari, not other browsers or apps.

A VPN (ideally with “kill switch”) + encrypted DNS would do the same for all traffic from your machine.

> Risky click disclosure: The GIF isn’t a GIF, it’s a JSON response containing full geo-location data on the requestor.

For the curious (a click through a proxy): https://archive.is/51hnq

   {
    "location":{
        "city":"Manassas"
        "country":"United States",
        "countryCode":"US",
        "state":"Virginia",
        "stateCode":"VA",
        "zipcode":"20109",
        "latitude":"38.7911",
        "longitude":"-77.5264",
        "continentCode":"NA"
    },
    "connectionDetails":{
        "isp":"G-Core Labs S.A.",
        "connectionType":"CORPORATE",
        "autonomousSystemNumber":"199524",
        "autonomousSystemOrg":"G-Core Labs S.A."
    },
    "ipHash":"801ccd1d1dd4a01f73b789c5c25d70cd",
    "classC":"45.135.229",
    "ip":"45.135.229.10"
   }

I'm 100% sure that I don't trust any company who feels the need to hide their data collection mechanism as a gif (or anything else).

You do realise that web servers often store logs of all requests, right? Those log records include the requesting IP address, from which all this information is derived.

looks like geoIP database - for me it gives almost same data as https://www.ip2location.com/demo/

It doesn't seem to be. MWB's location for me is much more accurate, I'm thinking Google?

For me it returns the same result as Cloudflare, and they are using Maxmind

I think it's one of their paid versions[0] with a few addons[1][2].

[0] https://www.maxmind.com/en/geoip2-precision-city-service

[1] https://www.maxmind.com/en/geoip2-isp-database

[2] https://www.maxmind.com/en/geoip2-connection-type-database

For me it's more accurate (in the correct state) but still off by a lot (several towns over)

How does anyone ever find such things in sea of minimized JS?

The network tab in the browser's dev tools will show you all of the resources loaded, including shady fake gifs

that is a really handy gif.

Reply on news.ycombinator.com