This is possible because Lemmy doesn’t proxy external images but instead loads them directly. While not all that bad, this could be used for Spy pixels by nefarious posters and commenters.
Note, that the only thing that I willingly log is the “hit count” visible in the image, and I have no intention to misuse the data.
The best part is it also works on DMs, so it’s trivial to get any persons IP address. Want an admins IP address? Just DM them a message with an embedded spy pixel.
I emailed the lemmy developers about this a few weeks ago since IMHO it’s a pretty big security issue, no reply.
I’m on kbin, so tell me: do the images open on their own on Lemmy? If not, then it works like any link one might send, image or not image. The server always can see the IP address, as it was never meant to be secret. This also assumes the admins always use a single network with a single static IP address.
Embeds are fetched and displayed without user interaction.
This also assumes the admins always use a single network with a single static IP address.
Not really. Send a DM to every single admin of an instance and wait until you get enough collected IP addresses. Pay someone running a botnet to flood those addresses for an hour or two.
Even with a dynamic IP address, you’re still stuck with it for a while. If you’re lucky, power cycling will get a new one immediately. If you’re not you get to enjoy waiting for a day or sitting on hold with your ISP’s support number, running through their scripted support process until you finally get to someone capable of helping.
This is possible because Lemmy doesn’t proxy external images but instead loads them directly. While not all that bad, this could be used for Spy pixels by nefarious posters and commenters.
Note, that the only thing that I willingly log is the “hit count” visible in the image, and I have no intention to misuse the data.
The best part is it also works on DMs, so it’s trivial to get any persons IP address. Want an admins IP address? Just DM them a message with an embedded spy pixel.
I emailed the lemmy developers about this a few weeks ago since IMHO it’s a pretty big security issue, no reply.
I think you’re overestimating the value of someone’s IP address. Not much one can do with it unless someone really tries to expose themselves.
Joke’s on you, I’m in front of 9 proxies. 🤡
1: DM all admins a spy pixel.
2: Coordinate a mass effort to spam rule-breaking posts and comments at some day.
3: Distributed denial of service attack on all admin IPs on that day.
…
Profit?
I’m on kbin, so tell me: do the images open on their own on Lemmy? If not, then it works like any link one might send, image or not image. The server always can see the IP address, as it was never meant to be secret. This also assumes the admins always use a single network with a single static IP address.
Embeds are fetched and displayed without user interaction.
Not really. Send a DM to every single admin of an instance and wait until you get enough collected IP addresses. Pay someone running a botnet to flood those addresses for an hour or two.
Even with a dynamic IP address, you’re still stuck with it for a while. If you’re lucky, power cycling will get a new one immediately. If you’re not you get to enjoy waiting for a day or sitting on hold with your ISP’s support number, running through their scripted support process until you finally get to someone capable of helping.
Didn’t knew you can DM on lemmy. Maybe the Jerboa devs have not implemented it yet.
Not really.
Same, I’m using an app.
Jerdoa