- This topic has 6 replies, 6 voices, and was last updated 6 years, 1 month ago by
.
-
Posts
-
I noticed a potential privacy and security problem with links to asset description.
My knowledge of the http protocol is a bit old and I may be wrong, but I prefer to signal it.Depending on the protocol used in the link, zonegfx seems to use two different ways to access the asset description
With http, you have to copy the link and use sth like "open link' or 'open link in a new tab' or copy paste in the address bar, etchttp://daz3d.com/victoria-8 (in posts, the link is not clickable)
With hhtps, the link is clickable
https://daz3d.com/victoria-7 (but this one is)
With the first method, from the browser point of view, it is similar to type the link address and daz will just notice the a user, say MrFoo, has accessed a page.
But the second one may create a security problem.
Indeed, when you click a link from a site; the browser may (or not) include the name of the original site (the referrer). I do not know if all browsers have the same default behavior, and this is a behavior that can be changed by the user and that one should not rely on.
Now assume that the referrer is included in the http header by the browser. What daz3d will see is that there is a page accessed, with zonegfx as the referrer and that MrFoo is the name of the user that looks at this page (auto log). If MrFoo accesses this way daz3D 10 times a day, 7 days a week, for several monthes, he will become a perfect suspect. If he has a site, daz may investigate on his renders to track the (unowned) assets. They may try to correlate his purchases at daz and the availabity of the asset at zonegfx, etc.I do not not know if daz does this kind of monitoring, and maybe most browsers do not include the referer in their http requests, but this is really risky IMO.
The simple fix is just to suppress the possibility to click from zonegfx.
This is how proceed most sites like 3dload, render-state, etcAs is the case with sites such as this one, ANY possible security issue is worth mentioning. You may not be an expert, and there might not be an issue - those that are will set things straight.
Unfortunately there are those that are not helpful, and see those that are as a threat, and lash out for the sake of something to do. Sad people.
Keep on asking about issues, we are all [?] trying to keep this site safe for sharing.I've been told by a couple of PA's that they are aware of pirate sites, which I assume includes this one. DAZ is as well. They won't even let anyone talk about pirating in their forums, hoping the masses are ignorant of it. Both PA's swore that pirates actually increase sales because 5-10% of pirates end up buying something from them.
The main problem is that people are not anonymous on daz. They can, if they logout at some point, but most (including me) do not.
I looked at the page code (and what I said was wrong: some links are clickable and some not, but it is unrelated to the http/https protocol used).
<p><code> <a href="http://www.daz3d.com/catalog/product/view/id/72543">http://www.daz3d.com/catalog/product/view/id/72543</a> </code><br />
It is just a simple html link. AFAIK, what does the browser in that case is completely independent of the site. So if the browser wants to tell daz that the referrer was zonegfx, nobody can stop him (except the user, but most, including me, do not know how to change the browser default behavior).Decent article that begins by focusing on cookies, but about three quarters of the way down it gets into all the methods websites have of tracking your movements. Anyone that would like a nice layman's overview should find the five minutes required to read through a worthwhile effort, Unless you find cookies really interesting, you can probably skip most of the cookie info, it's just explaining the technical side of how they work.
While there are plenty of ways to attempt to avoid sharing your referrer url, none of them is guaranteed. Even Anomyze occasionally doesn't load and instead you're taken directly to the link site. 🙁 If it's happened to me five times out of hundreds of links, it's likely happened thousands or tens of thousands of times in the life of the site.
Personally I always clear out my cookies before coming here and vise versa. It just seems a sensible precaution. As for sites like this, the servers are most likely in countries that don't care so much about minor copyright violations like 3D content, so there's no way they can close them down. The worry for me is if Daz implements some sort of tagging of content through DS that identifies content with purchaser. It's probably wise to block DS from connecting to and from the Internet through the Windows firewall.
- You must be logged in to reply to this topic.
