Unblock Flickr, from Explore to your own photostream

Your browser talks to TrickyBird, and TrickyBird fetches Flickr for you. It rewrites the HTML, CSS, and JavaScript so every link, thumbnail, and request points back through its own address, and a small script stays in the tab to catch whatever loads as you scroll Explore or open a photo. On every surface we measured, the sign-in included, 0 requests reached a flickr host.

Getting there took 2 fixes on our side, and both are the kind of fault that only bites on a network that really blocks the site. Flickr embeds a consent tool that reaches for browser storage in a hardened way our storage isolation did not survive. It threw an error that stopped the rest of Flickr’s code, so a photo page came up with the title, the description and the credits in place, and a blank rectangle where the photo belongs. That is repaired, and the repair covers any site that uses the same pattern.

The second fix was quieter. The same tool undid our rewriting of one of Flickr’s own script URLs, so Flickr went off to fetch a piece of itself directly. On an ordinary network nobody would notice. On a network that filters Flickr, that single request is the one that cannot succeed, and the page stops half-built. TrickyBird now repoints every element at the moment it is added to the page, so nothing goes direct.

The signed-out home page, the Explore photo grid, photo search, photo pages, and user photostreams all render, and their pictures load rather than turning into broken thumbnails. No account is needed to look around, and nothing installs on your side. Flickr is not the only image site our tests cover: Imgur and Pinterest have pages of their own.

Signing in works too, which is the part most proxy pages skip. Flickr keeps its sign-in on a separate site, identity.flickr.com, and the proxied session carries through to it. The email step and the password step both went through in our tests and landed on the signed-in home feed. Opening our own photostream afterwards showed the account with its avatar and the upload controls, and neither a captcha nor an emailed code came up.

The boundary is simple. TrickyBird is for reaching a public site your network blocks, and for keeping your IP address away from that site. It is not a way into an account that is not yours, and not a way past paywalls or copyright.

Flickr sees the connection coming from TrickyBird rather than from your IP address, and the network you are on sees a connection to TrickyBird rather than to Flickr. The Flickr name stays out of the URL, off the page, and out of the requests your browser sends, which is the part a filter would otherwise match on.

Signing in changes one thing: once you enter your own credentials, Flickr knows which account is browsing, the same as in any browser. On our side, the edge keeps a short access log to run the service and stop abuse: a shortened form of your IP address, the hostname of the site you connected to, and basic response details, kept for at most 48 hours. It does not record which photos you opened, and there is no TrickyBird account for any of it to attach to. Our privacy page has the full picture.