The Webmistress — Sat, 11 Aug 2001 12:25:06 +0000

This is what they actually say about the security issue on favicon.com :

What are the security/privacy concerns related to favicon.ico files?
We are told that Linux's Konqueror does not have any concerns since the browser checks for favicons whether or not the web surfer bookmarks your page. In Internet Explorer, however, when you bookmark a page the browser requests the favicon.ico file. The web surfer is unaware that a request has been made and users can not turn this feature off. The web site can then use their logs to build a record of the user's bookmarked pages. Visitors could then be tracked by a cookie. This would allow sites to build more profiles of visitors interests. Most people do not think the privacy concerns that result from this bookmarking/favicons scheme are anything to worry about. (No one has created a real uproar regarding the privacy issues related to favicon branded bookmarks)

mairving — Sat, 11 Aug 2001 12:06:30 +0000

Just be aware that there are some security problems using Favicon.

Below is some of the problems using favicon both on your client end and also the server end. The client side there is not much you can do about unless you want to switch browsers.

----------------------Favicon-------------------------------
In case you haven't heard, Microsoft has a new feature in IE 5.0 web browser. When you add a website to you "Favorites" (aka. Bookmarks for you Netscape users), the browser attempts to download a graphic called "favicon.ico", then show that icon along with the title of the webpage.

This has two risks.

First of all, the website owner is notified when you add the page to your favorites, revealing information about yourself. This privacy risk is probably minor, but I've seen several press articles on the subject.

The second RISK is much more severe. Go to AltaVista (or any search engine) and search for "favicon.ico". You now have a list of 500 websites that expose their access logs. In the logs, you can find several websites that
expose the URLs of CGI scripts, including passwords. Through manual searching, I found 2 sites that exposed logon information; I'm sure I can write a program that would scan those logs to look for CGI programs and get
even more. This also exposes even more privacy information because these logs often contain the Referer field as well.

This isn't unique to "favicon.ico". The RISK is really:

* people are unintentionally exposing access logs on their web sites, exposing user information and possible passwords.
* hackers can easily find vulnerable systems not by scanning the site itself (which can be detected by intrusion detection systems), but by searching a 3rd party like AltaVista.
------------------------------------------------------------

This has to be one of the most FAQs!

Suzanne — Sat, 11 Aug 2001 01:34:04 +0000

Have no fear, the answer is here: favicon.com

Suzanne