For full details, see: https://robinlinus.github.io/socialmedia-leak/
In short, the following code on a third party website:
<img onload="alert('logged in to SO')"
onerror="alert('not logged in to SO')"
src="https://stackoverflow.com/users/login?ssrc=head&returnurl=http%3a%2f%2fstackoverflow.com%2ffavicon.ico">
will call the onload
function if you are logged in to SO, and the onerror
function if not. This leaks information about me to other websites.
At least Instagram has fixed this by hosting its favicon on its CDN. I don't know if there are other solutions possible.
You are logged in to: No platform (or you're using something like Privacy Badger)
- This addon works well