How to disable favicons?

[Dancer18]

@Dancer18 said in How to disable favicons?:

Privacy Badger

@Gwen-Dragon
I posted this here before asking if the addon Privacy Badger will block favicon-tracking.

Nobody answered so far.

EDIT:// I also installed the extension ClearURLs that removes tracking-elements out of URLs.

[Streptococcus]

@guigirl
My solution was sufficient for my needs. I did not want my bookmarks file to be bloated to huge proportions by a bunch of stupid icons.

[Streptococcus]

@guigirl
If your bookmark is not supplying the favicon, how far can you be tracked with it?

[claudio]

Hi,this extension works.

[LonM]

I wonder if you could get around it by getting a blank favicons file from a fresh profile, copying that to your main, and making it read-only?

[TbGbe]

@LonM See what @Streptococcus said in How to disable favicons?:

I cannot stop the favicons from being displayed, but I can stop them from being saved. I did that by closing Vivaldi, finding the Favicons file in the Default subdirectory of the Vivaldi profile and removing it. Then I launched Vivaldi and immediately closed it again, and made the new empty Favicons file read-only. Now it cannot be written, and my bookmarks do not contain favicons.

[LonM]

@TbGbe Ah, I missed the earlier reply. Good to know that works.

[TbGbe]

@LonM said in How to disable favicons?:

Good to know that works.

As far as bookmarks are concerned, anyway.

[LonM]

@guigirl they would end up re fetching favicons if the database is not writable. But they would always fetch favicons, thus making the timing attack impossible (if I've understood it correctly). Unless there is somewhere else they are cached.

[TbGbe]

@guigirl said in How to disable favicons?:

... who's to say they're not inside the V cache directory? I mean, they're not there in plain-english name-format, but i dunno what all those weird files contain.

Everything you see in a tab/window/panel is in the cache (somewhere).
So you need to make favicons file read only, then ALWAYS use private/incognito window(s)!
Which you then close at least once a day - without saving sessions etc.

Problem solved :face_with_stuck-out_tongue_closed_eyes:

[LonM]

@guigirl I am not entirely sure. The favicons are apparently being fetched even though the favicons file is read-only. So they are obviously not being stored in that file.

What I don't know is if Vivaldi is fetching them every time the tab loads (i.e. they are not added to the favicons file nor a cache), in which case the attack should not be achievable.

If it is caching them somewhere (other than the Favicons file, which is where they are supposed to go), then you would still be vulnerable to the attack.

I don't know enough about the browser engine to know which it is doing.

(side note: you used to be able to visit chrome://view-http-cache/ to see what exactly was stored in the cache, but that's been killed off apparently)

[ch3f]

@henks

.tab .favicon {
    display: none !important;
}

[ch3f]

@guigirl that is correct. Also I found 2 extensions that block downloading of favicons, I Hate Your Favicons and the other is webRequest, unfortunately cant find a download link....yet

[snlj]

Looks like exploiting this vulnerability is no longer theoretical:
https://arstechnica.com/information-technology/2021/02/new-browser-tracking-hack-works-even-when-you-flush-caches-or-go-incognito/

Brave has already implemented blocking, and it looks like there are ways to accomplish it in other browsers. Can we get this ability now please?

[Streptococcus]

@TbGbe
Would not emptying the cache after each session be enough to at least stop tracking between sessions?

[Streptococcus]

@ch3f said in How to disable favicons?:

@henks

.tab .favicon {
    display: none !important;
}

Hiding or stopping display is not the same thing as blocking.

[TbGbe]

@Streptococcus You also need to consider bookmarks, history, sessions etc.

[Streptococcus]

@TbGbe said in How to disable favicons?:

@Streptococcus You also need to consider bookmarks, history, sessions etc.

I clear everything at the end of a session except cookies (the only ones I have are those I want to keep), passwords and of course the site settings.
The linked article from arstechnica.com seems to indicate that if favicons are not saved, the browser will not be tracked that way.

[JanS.]

Would also like to have the ability to prevent that kind of tracking if possible.

[Richard5987]

This is the necessary interaction should be followed to incapacitate the Favicons:

*Open Firefox.

*In the location bar type in the accompanying 'about:config' and hit enter.

*Search for 'program.
*Now two choices will show up 'browser.chrome.favicons' and 'browser.chrome.site_icons'

*Double click on every one of these choices to set them to bogus.

*Restart Firefox and no favicon will show up once more.