Note: This post now archived and as such no longer works

An external image showing your user-agent and the total "hit count"

  • Goddard Guryon
    link
    fedilink
    arrow-up
    16
    ·
    edit-2
    1 year ago

    It would be interesting to see just how much info is shared when lemmy requests the image. If there is [potentially] sensitive info being shared, the devs might be interested in working on it too (I have no idea how to check such a thing, this comment is just so I can find the post later when more people have shared their wisdom on it)

    • Muddybulldog@mylemmy.win
      link
      fedilink
      English
      arrow-up
      35
      ·
      edit-2
      1 year ago

      None (by Lemmy), as Lemmy doesn’t actually request the image (that would be proxying). Your browser requests the image directly by URL. Lemmy, technically, doesn’t even know an image exists. It just provides the HTML and lets your browser do the work.

      • A_A@lemmy.world
        link
        fedilink
        arrow-up
        16
        ·
        edit-2
        1 year ago

        Exactly. The text of this post is simply :

        ![An external image showing your user-agent and the total "hit count"](https://trilinder.pythonanywhere.com/image.jpg)
        I get the same result when I browse directly to the link.

        So, if OP links a malcious website we have a problem … (?).

        • Goddard Guryon
          link
          fedilink
          arrow-up
          9
          ·
          1 year ago

          Oh dangit, it’s simpler than I thought. So the only data being sent is…just whatever is sent in your average GET request.

          • newIdentity@sh.itjust.works
            link
            fedilink
            arrow-up
            13
            ·
            1 year ago

            Yes. It’s also a pretty standard way of serving images. A lot of Email clients do that too.

            That’s also how these services that show you when a email is read work.

        • newIdentity@sh.itjust.works
          link
          fedilink
          arrow-up
          6
          ·
          edit-2
          1 year ago

          Not really that huge of a problem. When making requests you also usually send a header which includes the user agent.

          The program just logs how many times the image has been requested and it reads the user agent data. No Javascript is actually executed.

          Well it might be possible to have a XSS somehow but I haven’t really done much research into this possibility.

          In general it’s a pretty standard way of handling embedded images. Email does this too. That’s how you have these services that can check if someone read a mail

      • CoderKat@lemm.ee
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        Yup. And to add, your browser will send things like:

        1. Your IP address. Technically this is sent by the OS doing networking and is unavoidable. At best, a VPN can hide this, because the VPN sits in the middle.

        2. Various basic request headers, which most notably contains user agent (identifies browser) and language headers, both which you can fake if you want to.

        3. Cookies for that domain (if you have any). Those can track you across multiple requests and thus build up a profile of you.

        • odbol@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          That’s why you should use a native app, which won’t send any of that identifying info (except for IP but there’s nothing you can do on that)