Lemmy Support

157 readers

1 users here now

Support / questions about Lemmy.

Matrix Space: #lemmy-space

founded 5 years ago

MODERATORS

dessalines@lemmy.ml

PSA: The Lemmy federation convention of hotlinking images to other peer federation servers makes it easy for a rogue instance to collect end-user IP addresses & browser strings, don't assume otherwise (lemmy.ml)

submitted 1 year ago* (last edited 1 year ago) by RoundSparrow@lemmy.ml to c/lemmy_support@lemmy.ml

5 comments fedilink hide all child comments

If you visit a popular community like /c/memes@lemmy.ml with your web browser, the images shown are hotlinked from the Lemmy instance that the person posting the image utilized. This means that your browser makes a https request to that remote server, not your local instance, giving that server your IP address and web browser version string.

Assume that it is not difficult for someone to compile this data and build a profile of your browsing habits and patterns of image fetching - and is able to identify with high probability which comments and user account is being used on the remote instance (based on timestamp comparison).

For example, if you are a user on lemmy.ml browsing the local community memes, you see postings like these first two I see right now:

You can see that the 2nd one has a origin of pawb.social - and that thumbnail was loaded from a sever on that remote site:

https://pawb.social/pictrs/image/fc4389aa-bd4f-4406-bfd6-d97d41a3324e.webp?format=webp&thumbnail=256

Just browsing a list of memes you are giving out your IP address and browser string to dozens of Lemmy servers hosted by anonymous owner/operators.

top 5 comments

sorted by: hot top controversial new old

[–] Kushan 6 points 1 year ago

Big instances surfing up content from smaller instances is invariably going to cripple them unless larger instances start locally caching that content.

[–] RoundSparrow@lemmy.ml 1 points 1 year ago

Now that is purely passive, just data collection from routine serving of images.

A rogue site could start serving crafted images to confuse users or cause NSFW content to appear on all other Lemmy sites where users were browsing a meme.

When you have small-time image hosts being used by the dozens, they likely aren't as worried about their reputation being burned by pranks like this.

[–] MarionWheeler 1 points 1 year ago

IP Address isn’t extremely precise, and I always run on the latest version of whatever browser I’m on, be it Safari or Edge.

[–] RGB@lemmyfi.com 1 points 1 year ago

This applies to any website. by visiting the website you give them your IP. the only way to mitigate this is to use a VPN.

[–] jbaber@lemmy.sdf.org 0 points 1 year ago

A "solution" to this might be for lemmy instances/apps to have the option to "load remote images" the way e-mail providers do. So I have to actively click to load the images. Could even be done per subscription, so I could declare that I just want everything loaded when I see lemmy.ml/c/pics but not in general, where I usually want text.