Re: [Trisquel-users] I can easily steal your privacy data. Even with disabled cookies and Javascripts.

[mampir]

You don't need any special service or software to do this.  You can easily do  
it with your computer and nc (netcat) – a program which is installed by  
default with Trisquel.

In this forum, you can embed an external images to your forum posts.  With  
this you can see the IP-address and information send by the browser of almost  
all who see your post.

You can make a post like this:


Hi, all!  Let me tell you something...
<img src="http://208.80.152.201/image.png"; alt="">
...


When a browser opens a web page, it sees many <img .../> codes like the one  
above.  For every such code a browser goes and tries to download an image  
from the given address.

In the example post above the embedded image and it's on a computer with an  
IP address of 208.80.152.201.  Practically all browsers will try to connect  
to it, even if the image doesn't really exists.  If this address is of your  
computer, then browsers will try to connect to it and identify themselves.

You can listen for browsers trying to get an image from you computer with the  
command:


sudo nc -vl 80


When a computer connects to another it gives its IP address, so it can  
receive replies.  When a browsers connects to a server it sends various  
information, including what kind of a browser it is.  The browser  
identification is optional and non-essential information, but generally all  
browsers provide it.

When someone tries to open the image you'll receive something like this:


Connection from 208.118.235.148 port 80 [tcp/http] accepted
GET / HTTP/1.1
Host: 208.80.152.201
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:20.0) Gecko/20130422  
Firefox/20.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive


You'll also need to configure your router for this to work, if you are behind  
one.

With the above information, it's hard to determine which forum user is  
actually assosiated with the IP-address and browser information, since many  
people will read the post.  But its not too hard, if you are a bit creative.

Also, most people won't notice someone embedding images of some strange  
address.