Privacy Issues about the favicon.ico File

Description

Every time you bookmark a page in MSIE 5 it will send to the web server a request for a file named favicon.ico (see "MSIE 5 favicon bug" for an explanation about what this file is, along other nice things). This give to web servers admins a way to know that someone has bookmarked it's site; the info includes the date and time of the operation plus the address IP of the machine which bookmarked the site, which can be used to identify you. This may or may not bother you.

Impact

MSIE 5 will reveal to web servers admins that you bookmarked their sites.

Workaround

It seems that it's not possible to turn off this feature, so if it really bother you, don't bookmark sites with MSIE 5 or don't use it at all.

If you access the net through a web proxy, it may be possible to block request for the favicon.ico file. Contact your network administrator for more information.

It seems that some of the so called "personal firewalls" have the ability of blocking specific request from your browser. If you use such program, it may be possible to block requests for the favicon.ico file too (YMMV). Consult the documentation shipped with the program.

What Microsoft is Doing

Microsoft was not contacted about this issue. They were already informed about a a much more dangerous issue about the favicon.ico file and only took a measure to fix it when it was fully disclosed on the net. I don't have plans to contact them about this privacy issue just because I don't want to waste my time anymore with this.

Disclaimer

All information contained in this page is for EDUCATIONAL PURPOSES ONLY. The author of this page can not be made responsible for any damage caused by the use or minuse of information here contained.

Related Documents

About

This issue was discovered in april 1999 by Flavio Veloso <flaviovs at magnux dot com>.