What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can get all the analytical data you can about their question.

So a malicious user could theoretically post some posts and such with a small 1x1 image, which would allow him to get users IP addresses (thus general location/even workplace), exact times people visited his question, et cetera.

Maybe you don't care—such information isn't that revealing. However, some users might not feel the same.

(Suggested fix: only allow images from a list of image hosting sites you can vouch for.)

share|improve this question
11  
Better idea: let SO host all the images. –  Earlz Jul 2 '10 at 0:49
10  
And also, security != privacy –  Earlz Jul 2 '10 at 0:50
    
I reported the same thing to the phpbb team a while ago regarding PMs, as most email clients block external images. They didn't see it as worth fixing. –  Gelatin Jul 2 '10 at 1:00
    
Good point about privacy vs security. –  Aaron Yodaiken Jul 2 '10 at 3:26
    
Doesn't SO locally cache externally linked images? Or is that just for the Free OSS ads? –  detly Jul 2 '10 at 3:39
    
@detly, no. It doesn't appear to. –  Aaron Yodaiken Jul 2 '10 at 17:47
    
Is there anything that anybody can do about this? –  Aaron Yodaiken Jul 5 '10 at 2:05
    
Related - The other issue is a potential area where someone can phish for passwords from your users: meta.stackexchange.com/questions/115178/… –  Brandon Montgomery Dec 7 '11 at 20:39
    
@Earlz Security != Privacy, but Privacy is really a sub-set of Security - a part of the "C" in "CIA" (Confidentiality, Integrity, Availability). –  Iszi Aug 29 '12 at 13:15

5 Answers 5

So what? Folks can track your viewing habits - that's a part of using The Web. Hopefully you already have off-domain cookies turned off, but if not then do that. If you're really concerned about it, use a proxy...

share|improve this answer
2  
I dunno. It seems a bit dodgy that you can post an image link in chat and suddenly get an instant snapshot of everyone’s IP who is in that room — plus the occasional ghost-mod who is tail -fing the log without being “in” the room. Since you see when people show up to the room, and you see the new IP appear at the same time, it is pretty easy to see who is who. Is this desirable? –  tchrist Jan 13 '13 at 13:51
    
If you want, you can come talk to us about it at ELU chat, where we were discussing it this morning. And yes, I’ve turned off the tracker. :) –  tchrist Jan 13 '13 at 15:50
    
I donno... You might find out roughly where I live without looking at my profile; that'd be... terrible? –  Shog9 Jan 13 '13 at 17:22
    
Yeah, it means I could invite you to coffee in Boulder. :) –  tchrist Jan 13 '13 at 17:23

Demonstration:

sneaky.php

Disclaimer: This image and its contents are neither affiliated with nor endorsed by Google Inc. and are intended exclusively for humor.

share|improve this answer
3  
-1 for getting my city wrong. –  John Dec 8 '11 at 3:58
    
I'm not from Dinteloord :P –  rightfold Feb 7 '12 at 16:25
    
LOL That is where I live –  Parth Kohli Jan 13 '13 at 15:19
    
I am from ", Ireland", it tells me. –  TRiG Feb 7 '13 at 20:52

Now that image hosting on imgur.com is supported perhaps all other sources should be blocked?

It isn't nice to hotlink anyway.

share|improve this answer
14  
That would break a lot of questions and answers if the block was retroactive. Besides, banning hot linking from XKCD might result in a revolution. –  Tim Post Aug 24 '10 at 13:54
    
I can has tommy drop tablez som moar? (I'm so sick of that strip) –  jjnguy Aug 24 '10 at 14:09
4  
@jjnguy: His name is "Little Bobby Tables". –  zneak Aug 24 '10 at 17:37
    
@zneak, whatever his name is...I hate him! :P –  jjnguy Aug 24 '10 at 17:40

A fairly high fraction of questions and answers get edited by high-rep users, and an unexpected image link in there would likely attract both deletion and a flag for moderators to squelch the user.

share|improve this answer
4  
It could also be a totally legit-looking URL. Besides, prior to reading this, would I see a link to an image that didn't show up, I don't think I would have done anything about it. –  zneak Aug 24 '10 at 17:36

Depending on the available bandwidth, SO could also act as a proxy server (obviously caching the images).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .