I realized this was possible years ago but people told me I was crazy and that it was impossible.
https://www.ghacks.net/2021/01/22/favicons-may-be-used-to-track-users/
Add a comment
|
1 Answer
No, Tor Browser does not block favicons.
From the paper:
Nonetheless, browsers like Brave have recently adopted built-in anti-fingerprinting techniques which can affect our attack's performance (while Tor has done so for years, we do not consider it in our experiments since it is not susceptible to our favicon attack).
So this is not an issue for Tor Browser.
As part of our experiments we also test Firefox. [...] In fact, while monitoring the browser during the attack’s execution we observe that it has a valid favicon cache which creates appropriate entries for every visited page with the corresponding favicons. However, it never actually uses the cache to fetch the entries. As a result, Firefox actually issues requests to re-fetch favicons that are already present in the cache. We have reported this bug to the Mozilla team, who verified and acknowledged it. [...] Nonetheless, we believe that once this bug is fixed our attack will work in Firefox, unless they also deploy countermeasures to mitigate our attack [...].
It's also not an issue in the current Firefox.
