Allowing images from external sources opens doors to serious security exploits and privacy risks

Question

Note: Please see this answer for more info on how this poses a security risk.

I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can get all the analytical data you can about their question.

So a malicious user could theoretically post some posts and such with a small 1x1 image, which would allow him to get users IP addresses (thus general location/even workplace), exact times people visited his question, et cetera.

Maybe you don't care—such information isn't that revealing. However, some users might not feel the same.

(Suggested fix: only allow images from a list of image hosting sites you can vouch for.)

Answer 1

I strongly recommend blocking non-Stack-hosted images in posts and messages going forward. The potential harm may not be severe, but it exists and there is no benefit to balance it out.

Reasons to leave them:

• To avoid inconveniencing editors of old posts, as we already do for HTTP images and protocol-relative images.

• Nothing else?

Reasons to block them:

• Eliminate potential dependencies on external resources, as we generally require.
• Prevent posts from becoming broken if an image host decides to shut down.
  • As an example, one large, 15-year-old image host, TinyPic, shut down August 26, 2019.
• Prevent images from being changed without triggering an edit in Stack Exchange's system.
  • As an example, image host ImageShack once decided to use old, broken image URLs for advertising purposes.
• Avoid sending traffic to servers that may not want it.
  • As a consequence, if the server owner decides to prevent hotlinking (such as what happened with Photobucket), posts won't break.
• Prevent silent analytics of posts/tracking of users.
• Prevent phishing of user credentials with browser authentication dialog. (Some browsers prevent it, but IE, Edge, and in some cases Firefox, don't prevent it.)

<img src="https://stack-exchange-login-dot-com-dot-me.glitch.me/">

• Prevent CSRF attacks such as changing users' page size and sorting preferences.

<img src="https://meta.stackexchange.com/questions?sort=frequent&pagesize=15">

• Prevent users from posting images that can freeze the page, which may be irritating to clean up if moderators and other users are using affected browsers, such as Chrome.

Answer 2

Yes PLEASE. I have spent a lot of time Removing link shorteners from posts! and many of the blacklisted link shorteners are actually image hosting services, so I have experience dealing with this.

Many image hosting services delete their images after a certain period of time. After this has happened, it can be IMPOSSIBLE to get a replacement.

There is only one image I can remember that I was able to find a suitable replacement for. The only reason I could was because it was of a pop up in a very popular tool, and the question essentially dictated what it said.

There is still a lot of work to be done with removing banned image links. yfrog.com alone has 200 hits.

A number of questions relied on now broken images to be coherent. It's impossible to answer a question when all it says is:

How do I get this effect in jQuery?

I want to do this in jQuery:

<image src="dead.li/nk">

(Yes, this is loosely based off personal experience.)

By my calculations, there are about 20k+ different posts (on Stack Overflow alone) that have inlined images that aren't from i.sstatic.net:

Select id as [Post Link], body
from posts

where body like '%<img src="http://[^i]%'
   or body like '%<img src="https://[^i]%'

This probably misses a great deal, like ImageShack images. It's also not running quick enough on some sites, so it may need to be tweaked if you're going to run it (e.g. by returning top 100 only).

I think that the best solution would be to automate as much of this as possible. Would it be possible to have Community find all the posts with live inlined images, upload them to Imgur, and replace it with the new link? In the past it helped to transition links during the great meta schism and then again during the switch to HTTPS. (The latter change also messed up posts with inlined external HTTP images, something that still needs fixing on most sites.)

Another solution would be to give a warning when editing a post that contains an inlined external image. While this doesn't solve the problem directly, it at least makes sure that people know it's a problem so it can be fixed on a case-by-case basis. It would look something like this:

Answer 3

What is possible with this vulnerability?

Oh, it's way worse than tracking.

• Determining the IP addresses of specific chat users or (with less accuracy) highly active users on main
  • This involves finding mutliple rooms the user is in, scraping the IPs of the users in them, and finding the intersection
  • This can be used to detect when certain people view the transcripts of a room, something often done by moderators specifically to avoid their presence being known
• Editing the content of an image after some time, such as to make a diagram in an answer into something offensive without bumping the post
  • This could also happen unintentionally, if you lose control of the domain that's hosting the image (and tracing who's responsible would then be difficult)
• Gaming the Announcer-class badges
• Making it appear to network administrators that people on school or work computers are navigating to porn sites
• Phishing passwords from people using old browsers
  • People using older browsers are also more likely to be older, and more likely to fall for phishing attacks
• Silently taking advantage of certain CORS vulnerabilities in other sites
• Freezing users' browsers with specially crafted SVGs, or exploiting code execution vulnerabilities in the SVG parser (which are not uncommon)
  • This is difficult to remove
• Use advertising links to make money
  • This also could include faking view counts on some platforms
• Feel free to add any others

Additionally, after these "images" (usually not actually images) are removed from an offending post, one can link to the revision page, which appears trustworthy but still contains the payload.

If you know that a post contains an offending image, and must view it, disable images (typically an option under site settings).

If you see a post containing one of these images, flag for moderator intervention, explain the problem, and request for the revision history to be nuked.

Answer 4

Now that image hosting on imgur.com is supported perhaps all other sources should be blocked?

It isn't nice to hotlink anyway.

Answer 5

What external images bring to a conversation

The Good

• A more relate-able way for many people to understand the metaphor you want to use
  Many people aren't able to visualize what you mean, so visualizing it for them helps
• Really fun puzzles
  See puzzling. There are some great image based ones there
• Troubleshooting through screen grabs
  Many things would be MUCH harder to do without this on many SE sites

The Bad

• Scripting
  SVGs and other active image content is dangerous here
• Page size
  The bigger the image, the longer the load
• Tracking
  A lot of people are concerned about anonymity for the wrong reasons and it breeds some misunderstanding
• Policing
  We need to make sure things that shouldn't be on SE, AREN'T on SE

My take?

I'm gonna have to say that we need to do it in a way we can trust it. There is a way to do this that most people will probably accept

• Official Host
  All images need to be posted here, no hot linking
• Restricted formats
  If it's not PNG, JPEG, or GIF it doesn't get loaded
• Lazy Loading
  This way if it's a large image it will be loaded only when clicked on or needed, and long page loads won't happen

Answer 6

Depending on the available bandwidth, SO could also act as a proxy server (obviously caching the images).

Answer 7

A fairly high fraction of questions and answers get edited by high-rep users, and an unexpected image link in there would likely attract both deletion and a flag for moderators to squelch the user.

Answer 8

So what? Folks can track your viewing habits - that's a part of using The Web. Hopefully you already have off-domain cookies turned off, but if not then do that. If you're really concerned about it, use a proxy...