Privacy and security

Deutsche Fassung

This page sums up what you as the operator need to know before the extension runs on a public website. The points come from the security audit for version 2.7.0.

Which data leaves your server

Every request to the Backlinkseller service transmits:

• your Backlinkseller ID
• the page address being requested
• the visitor's IP address

According to the imprint of backlinkseller.de the recipient is Intelions OÜ, Pae 25-47, 11414 Tallinn, Estonia. Estonia is an EU member state — so this is not a transfer to a third country. You need the name to identify the recipient in your privacy policy.

The IP address is taken from the connection itself and never read from request headers — it therefore cannot be forged from outside.

Cache and IP address

The cache is keyed by ID, page address and channel, not by visitor. As long as an answer sits in the cache, no request is made — and therefore no IP address is transmitted. A higher cache time thus reduces the amount of data passed on.

Unencrypted connection

The request goes over http://. That is not negligence on the part of the extension but a constraint of the service: the request servers channel1 through channel9 accept unencrypted connections only — port 443 is not open there, a connection attempt is refused. (The website backlinkseller.de itself is reachable over https; the request servers are not.) The provider's own official integration code addresses port 80 as well.

Whoever controls the connection in between could in theory alter the answer.

What such an interference could achieve is deliberately kept narrow. The extension does not adopt the answer as HTML but reads out individual values on purpose:

• Addresses are validated; only http and https are allowed. javascript: and similar addresses are excluded.
• Fixed lists of permitted values apply to rel and target.
• All remaining text is stripped of any markup.
• All output is escaped. Scripts, event attributes or embedded frames cannot reach the page this way.
• The answer is limited to 100 KB and 100 entries.

A residual risk remains: an attacker in that position could substitute links other than those Backlinkseller intended. As long as the service offers no TLS, that cannot be ruled out from this side.

Availability

If the service does not answer, the extension tries a second address and then gives up. Each attempt waits at most 5 seconds — so in the worst case the page build takes about 10 seconds longer.

Error responses are deliberately not cached, so that a disruption recovers by itself as soon as the service is reachable again. The flip side: while the disruption lasts, every page view pays that time.

What the extension does not do

• It creates no database tables of its own and stores no visitor data.
• It sets no cookies.
• It fetches nothing as long as no element is placed on the page.

Applies to version 2.7.5.

Deutsche Fassung