Hacker News Reader

Comment by ThePowerOfFuet | Hacker News Reader

>My belief is that a website should not be notified and given your IP address and other information such as hardware device type and web browser version when you share the URL of the website.

The user was just on that website, so that was water under the bridge before they even brought up the Share menu.

All respect to Jeff, but this is a nothingburger.

View on HN

> The user was just on that website

No, the user was not just on that website. You didn't look at the example closely enough. The contextual menu was on an external link.

When you share links with people, many (most? at this point) include previews. Those previews are performed on the sender side, e.g. the person sharing the link. The "Sharing" view is part of macOS and iOS, not part of the browser - any other browser or app can also use the sharing pane and also be a recipient of the information being shared. If the recipient service/sharing extension needs or supports preview images, then the sharing view produces them, which requires network loads. In this specific case there isn't even a question of "can you use, or is it appropriate to use, safari's local render?" because no such render exists.

You've repeated your main comment https://news.ycombinator.com/item?id=38028909 multiple times in these threads, but you're misinformed. Read my reply to that comment.

Website A can link to Website B which you might want to share. You might not want to visit B however, for some arbitrary reason. Plus, it seems like its very easy to track who shares your website on iOS now since only favicons will be requested.

Websites can contain links to other websites. But, even for links to the same website, the user agent and unique combination of requests is enough to identify this as use of the share menu and track which users/IPs/whatever shared links to your website.

Definitely can be classed as a privacy violation.

Say I was in a web chatroom using SSL and someone posted a link to a piracy site. I right click and want to share it. Previously only the chatroom administrator could have known that my IP saw that link. But now, my ISP or anyone sniffing packets on the network would be able to see that I inadvertently accessed the URL. Regardless of whether or not I did anything else on the website, I could possibly get into trouble for simply requesting content from it.

Maybe instead it's a link to a site that sells abortion pills and I'm a pregnant woman under a government that forbids them. I share it with someone else but don't access it myself. Maybe I have a miscarriage and the government suspects it's actually an abortion. They get a warrant for ISP records and now there's proof I accessed a site selling abortion pills despite never actually going to the website.

Or maybe it's a link to an IP stealer. Someone asks you to share it with someone else. You don't click the link but they still grab your IP anyway when you go to share it.

I can think of numerous other examples of how a compromising URL could expose your activities even if you didn't actually click on the link. I don't really see a need for downloading a preview favicon. It just exposes you for no reason and could provide just another possible attack vector

If the site uses HTTPS and you're using DoS then this is not an issue. If you're extremely worried about this sort of things (which are bizarrely unlikely scenarios in first place) then you're already playing with fire by browsing the internet or going anywhere near these sites in general, because it's really not that hard to accidentally end up on these type of things (load wrong page, mis-click, whatever).

Reply on news.ycombinator.com