"why not alternative", would be better framed as, "here's a fun variation" — because both approaches are just playing around with technology, for fun / curiosity / exploration. Storing in the pixels is a fun approach, resulting in something Rube Goldberg-esque.
weetii 9 hours ago [-]
Hey, yeah, I wrote the article. This (of course) would be more practical. Thanks for pointing it out. I wanted the payload to "live" in actual pixel data rather than hidden text inside an XML file. That’s why I went this way :)
peter-m80 9 hours ago [-]
The ico file format allows multiple resolution icons, so a lot of data
weetii 9 hours ago [-]
Good point, I might add a section in the article where I list alternative approaches. Thanks
chrismorgan 6 hours ago [-]
Regular expressions? Ugh. Encode it properly as XML in the correct namespace, load it so, and take it from that.
Or just serve the SVG file and use <foreignObject> to embed the HTML, and include <link rel="icon" href=""> inside it. In theory you should be able to define a <view id="icon"> and use <link rel="icon" href="#icon">, but in practice neither Firefox nor Chromium seems to be handling that properly in a favicon, which is disappointing.
Tepix 3 hours ago [-]
It's a hack. A one-liner. Go crazy with it. Or touch grass ;-)
Oh yeah and favicon isn't part of the DOM.
reichstein 5 hours ago [-]
Just because it's my windmill to tilt at: `[\s\S]` can be written shorter and more precisely as `[^]`.
MomsAVoxell 5 hours ago [-]
[\s\S] vs. [^]
A quixotic windmill tilt if ever I saw one.
GoToRO 5 hours ago [-]
ai says [^] is not portable; I did not test it. Too bad, I'll stick to [\s\S].
spiesd 2 hours ago [-]
Too bad, indeed. It's well-defined in javascript (and thus, appropriate in this admittedly niche context). It's non-portable across different regex engines, yes.
berkes 7 hours ago [-]
An SVG can embed raster images: base64 encoded bytes.
So you could layer this experiment: favicon is svg, that contains encoded raster, whose bytes are encoded html.
At the very least it would make a mindboggling CTF step.
Retr0id 3 hours ago [-]
> You still need a tiny bootstrap loader to decode the image.
Nope, you can do it all in a single file with an html/png polyglot (and nowadays you can get better compression ratios with newer formats like webp).
You can use the favicon cache as storage too, by redirecting users across domains. It's been proposed as a potential fingerprinting risk[0], and if a browser naively reuses the cache for incognito mode, it could be used to track users across browser profiles.
My thoughts instinctively went to "this has to be being used for fingerprinting" when I read OPs blog. Are anti fingerprinting measures taking into account the use of the canvas api with favicons?
The link to the supercookie site is dead unfortunately.
franciscop 10 hours ago [-]
Is this timing coincidence? I just submitted 1h (30 mins before this) ago a website I just made about storing your stock porfolio in a URL + favicon!
PNG has comment chunks tEXt, zTXt, and iTXt. You can have a completely normal image whose file is stuffed with as much content as you want. That is less fun, I suppose.
weetii 9 hours ago [-]
Yes, that would also work, thanks for pointing it out
esquivalience 8 hours ago [-]
I found the agressively staccato, clearly LLM-generated content extremely difficult to read.
k2enemy 5 hours ago [-]
Halfway through I was sure that there would be a reveal at the end of the article that the article itself was stored in the site's favicon, thus explaining the short, terse sentences. I was genuinely disappointed when I realized it wasn't. Missed opportunity!
benhill70 3 hours ago [-]
I like the way it's written. I often write in a similar manner and I have never used LLMs to generate an writing for me. I have written exactly this way at work.
Too me, the author is just trying to get to the point. They know people start skimming if there is too much text.
istjohn 51 minutes ago [-]
I found the writing engaging and enjoyable to read.
bstsb 7 hours ago [-]
for the first time in a while on HN, i disagree with the characterisation as AI-generated. at most it was drafted with an LLM, but the final output is pretty human to me.
they used the wrong it’s/its, made But. its own one-word sentence, didn’t capitalise HTML, and used “okayy” in parenthesis. all of this isn’t to criticise the writer - i enjoyed it more seeing these little imperfections that make up a blog post
FWIW -- I'm not as repulsed by it as the parent comment. But I do want to substantiate that it _is_ heavily LLM-written.
(If you're unfamiliar, Pangram has garnered a reputation as the leading LLM-detector, with a minimal rate of false positives; IME this has come with the tradeoff of being easy to manipulate/tweak your way into turning an LLM-generated piece of text into reporting a false negative, but for most folks that's worthwhile.)
darianvc 5 hours ago [-]
People do be having too much time...
Is the navigation of the site also AI generated? This doesn't make any sense and proves why these AI detectors don't work
MomsAVoxell 5 hours ago [-]
I have been writing for a long time, and using AI for as long as it was available to me, and I have noticed that I get accused of being an AI more and more - and I do not think that is because I am an AI, but because we are all being consumed with the AI mind-set, and thus the AI is taking over our thinking - so perhaps subconsciously, I am indeed formulating my thoughts in a more AI-centric manner, prompting the association across the vast distances of the internet by other human beings (- or, AI) of my conscious thought, with an artifice.
This is a banal insult, but it is also a dire warning wherever I see it - these days, people moaning about being AI may as well just be AI - automatic ignorance - but .. I do have to wonder.
Am I, AI?
estetlinus 8 hours ago [-]
It’s the new internet. So, so annoying.
scottmcdot 8 hours ago [-]
Which bit? The short sentences?
bonoboTP 2 hours ago [-]
Not just the length but the structure, the way the headlines are phrased, the use of "honestly", the "not X but Y", many things cumulatively, not one particular thing in itself. If you work a lot with LLM writing, you notice. Same way you recognize the writing style of famous authors. It's never one particular thing but many.
bonoboTP 2 hours ago [-]
Agreed. Disappointing that more people don't notice it's AI.
noduerme 8 hours ago [-]
Yeah, but it's kinda weird. The typical LLM headers and bullet points are there, but it's like someone took an axe to the rest of the spew. I too would rather read someone's original bad writing than their bad editing of AI writing, but it's kinda interesting how this all shakes out.
netsharc 6 hours ago [-]
It doesn't seem to be LLM, but reads like one. The author is German, maybe it's a language expertise thing, maybe he likes the LLM style (unrelated to his nationality).
But yeah, sentences that only have 3-4 word each feel like 3rd grade writing; I couldn't read it.
weetii 6 hours ago [-]
Hey, I've always written like this. In school I couldn't stand subordinate clauses and long sentences because I'd lose my train of thought. But yea, I've noticed that people often find it hard to read so I'm going to work on that
SoMomentary 3 hours ago [-]
I actually feel the opposite of what most people are saying here. I thought your writing style was great. It felt like you respected my time as a reader and got to the fucking point.
I thought the lack of fluff was refreshing!
darianvc 5 hours ago [-]
You're good fr. People on here who try to make their day about being AI detectives. You're trying to work on it and that's what matters
cubefox 3 hours ago [-]
Did you use an LLM to write at least part of the article?
darianvc 5 hours ago [-]
Might stop using bullet points for not being flagged as AI lol
"Very small" -> yeah, this header is mostly AI generated. No hate against the author but this doesn't make any sense as header
bartvk 8 hours ago [-]
I wish people would include their prompts.
MomsAVoxell 5 hours ago [-]
Oh, I am so aligned with this mentality:
A monitor is storage.
A keyboard is storage.
Forum posts are storage. Markov-approved tweaks in an edit, over time, certainly enough for quite a lot of storage. Dual-use storage to boot, since .. you know .. sometimes the comments are socially interesting.
Best thing is, nobody really knows if their chicken casserole recipe isn't just a handle to a carefully constructed GUID pointing across to .. lets say, for humor .. a thousand different forum postings ...
I do have to wonder if the author is familiar with PoC||GTFO, for this is certainly a technique one will find deep within the depths of the Alchemist Owls' holy tomes...
drob518 12 minutes ago [-]
Codes within codes. Wheels within wheels.
echoangle 1 hours ago [-]
> The length header is important because the image itself may contain unused pixels at the end. If there's no length value, there's no way to know where the real payload stops.
Not really, can’t you just pad with 0 bytes and stop reading when you encounter one that’s not part of the current Unicode codepoint?
divvsaxena 56 minutes ago [-]
This is one of those projects that's completely impractical but makes the web more interesting. I love seeing people explore weird constraints just to see what's possible.
jorisw 7 hours ago [-]
Fun Fact: You can use any inline SVG for a favicon and keep it right in the HTML document.
This also allows you to use an emoji directly as a favicon, like so:
Cool! Here is a GH repo demonstrating unbounded favicons I made 11 years ago - it crashes some browsers - wanna guess how long it took each one to fix it :D https://github.com/benjamingr/favicon-bug
That’s awesome. I took this a bit further a few years ago making a url only notepad quine that as you add data to it, creates itself. that can be saved as a bookmarklet. Have to watch the gif to understand
Have an index.html that's also (byte-to-byte equal) served as favicon.ico. If that page "works" and the favicon doesn't show garbage, it is a website stored in a favicon (by my standards).
berkes 7 hours ago [-]
I'd imagine the (aggressive) caching of the favicon by browsers makes it a challenge, but you could generate the favicon dynamically, then have JS extract the sequentially. Basically streaming arbitraily large content to a webpage via favicons. Via blocks of 239 bytes.
It may be a fun, novel way to proxy webpages that are otherwise blocked. Though, i guess, the service rendering the favicons can just as easily be blocked then.
herodoturtle 5 hours ago [-]
How long before someone ports DOOM into a favicon? ^_^
(For the technical gurus here, would that even be possible?)
drob518 11 minutes ago [-]
3… 2… 1…
shakna 5 hours ago [-]
You can already play it in a favicon [0].
But as favicons can be svgs, and let you store foreign objects... You could store the whole thing in the favicon, but might also need a line of JS to extract it.
The browser already asks for the favicon on every page. Might as well put it to work.
Izmaki 6 hours ago [-]
Wait 'til the author discovers that you can use ping (ICMP) to transfer data, too! :)
aaubry 6 hours ago [-]
A neat improvement would be to make the decoder into a bookmarklet. This would avoid the overhead of serving the script. Of course you would rely on the user having the bookmarklet installed, but when you serve HTML you also rely on the user having a web browser installed.
superjose 10 hours ago [-]
Pretty cool tbh!!! Would have loved seeing the decoder code!!!
It's also pretty interesting to think how an attacker could exploit images on his behalf. Never thought that would be a way!!!
Thanks!
schobi 9 hours ago [-]
I guess the decoder is more than the 208 bytes that this page uses..
But maybe you can misuse this and store a session ID / cookie in a favicon (give everyone a unique one) and survive some cookie cleanup and evade privacy restrictions?
Maybe you can still make it that the favicon looks like an image a little to not raise suspicion?
Favicons seem to be cached across private browsing sessions. Oh no
RetroTechie 6 hours ago [-]
I'm tempted to think that only someone working for a company in the advertising industry could come up with that.
Must EVERYTHING be polluted by ad tech & privacy intrusions?
beardyw 9 hours ago [-]
I would have used a minimal service worker to unpack the web data and present it as if it were just a normal page being loaded.
Use this favicon.svg:
use this in your <head> to use a svg favicon: finally, use this in your <body> to extract it and add it to your document body:Or just serve the SVG file and use <foreignObject> to embed the HTML, and include <link rel="icon" href=""> inside it. In theory you should be able to define a <view id="icon"> and use <link rel="icon" href="#icon">, but in practice neither Firefox nor Chromium seems to be handling that properly in a favicon, which is disappointing.
Oh yeah and favicon isn't part of the DOM.
A quixotic windmill tilt if ever I saw one.
So you could layer this experiment: favicon is svg, that contains encoded raster, whose bytes are encoded html.
At the very least it would make a mindboggling CTF step.
Nope, you can do it all in a single file with an html/png polyglot (and nowadays you can get better compression ratios with newer formats like webp).
https://web.archive.org/web/20120801001616/http://daeken.com...
[0]: https://www.schneier.com/blog/archives/2021/02/browser-track...
The link to the supercookie site is dead unfortunately.
https://news.ycombinator.com/item?id=48606396
Too me, the author is just trying to get to the point. They know people start skimming if there is too much text.
they used the wrong it’s/its, made But. its own one-word sentence, didn’t capitalise HTML, and used “okayy” in parenthesis. all of this isn’t to criticise the writer - i enjoyed it more seeing these little imperfections that make up a blog post
FWIW -- I'm not as repulsed by it as the parent comment. But I do want to substantiate that it _is_ heavily LLM-written.
(If you're unfamiliar, Pangram has garnered a reputation as the leading LLM-detector, with a minimal rate of false positives; IME this has come with the tradeoff of being easy to manipulate/tweak your way into turning an LLM-generated piece of text into reporting a false negative, but for most folks that's worthwhile.)
Is the navigation of the site also AI generated? This doesn't make any sense and proves why these AI detectors don't work
This is a banal insult, but it is also a dire warning wherever I see it - these days, people moaning about being AI may as well just be AI - automatic ignorance - but .. I do have to wonder.
Am I, AI?
But yeah, sentences that only have 3-4 word each feel like 3rd grade writing; I couldn't read it.
I thought the lack of fluff was refreshing!
"Very small" -> yeah, this header is mostly AI generated. No hate against the author but this doesn't make any sense as header
Best thing is, nobody really knows if their chicken casserole recipe isn't just a handle to a carefully constructed GUID pointing across to .. lets say, for humor .. a thousand different forum postings ...
I do have to wonder if the author is familiar with PoC||GTFO, for this is certainly a technique one will find deep within the depths of the Alchemist Owls' holy tomes...
Not really, can’t you just pad with 0 bytes and stop reading when you encounter one that’s not part of the current Unicode codepoint?
This also allows you to use an emoji directly as a favicon, like so:
(HN isn't showing the emoji)https://github.com/con-dog/serverless-architecture
It may be a fun, novel way to proxy webpages that are otherwise blocked. Though, i guess, the service rendering the favicons can just as easily be blocked then.
(For the technical gurus here, would that even be possible?)
But as favicons can be svgs, and let you store foreign objects... You could store the whole thing in the favicon, but might also need a line of JS to extract it.
[0] https://vidferris.github.io/FaviconDoom/
Related interesting project: https://github.com/EtherDream/web2img
It didn’t load first time round on my browser (Brave) without disabling its prevent tracking feature…
Wallet password.
New ecosystem for the kids.
That's two, at least.
It's also pretty interesting to think how an attacker could exploit images on his behalf. Never thought that would be a way!!!
Thanks!
But maybe you can misuse this and store a session ID / cookie in a favicon (give everyone a unique one) and survive some cookie cleanup and evade privacy restrictions?
Maybe you can still make it that the favicon looks like an image a little to not raise suspicion?
Favicons seem to be cached across private browsing sessions. Oh no
Must EVERYTHING be polluted by ad tech & privacy intrusions?
cp index.html favicon.png