this post was submitted on 17 Jun 2023
1 points (66.7% liked)

Lemmy Support

4629 readers
3 users here now

Support / questions about Lemmy.

Matrix Space: #lemmy-space

founded 5 years ago
MODERATORS
[email protected]
1
PSA: The Lemmy federation convention of hotlinking images to other peer federation servers makes it easy for a rogue instance to collect end-user IP addresses & browser strings, don't assume otherwise (lemmy.ml)
submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]
20 comments fedilink hide all child comments
 

If you visit a popular community like /c/[email protected] with your web browser, the images shown are hotlinked from the Lemmy instance that the person posting the image utilized. This means that your browser makes a https request to that remote server, not your local instance, giving that server your IP address and web browser version string.

Assume that it is not difficult for someone to compile this data and build a profile of your browsing habits and patterns of image fetching - and is able to identify with high probability which comments and user account is being used on the remote instance (based on timestamp comparison).

For example, if you are a user on lemmy.ml browsing the local community memes, you see postings like these first two I see right now:

You can see that the 2nd one has a origin of pawb.social - and that thumbnail was loaded from a sever on that remote site:

https://pawb.social/pictrs/image/fc4389aa-bd4f-4406-bfd6-d97d41a3324e.webp?format=webp&thumbnail=256

Just browsing a list of memes you are giving out your IP address and browser string to dozens of Lemmy servers hosted by anonymous owner/operators.

all 21 comments
sorted by: hot top controversial new old
[–] [email protected] 2 points 1 year ago

A "solution" to this might be for lemmy instances/apps to have the option to "load remote images" the way e-mail providers do. So I have to actively click to load the images. Could even be done per subscription, so I could declare that I just want everything loaded when I see lemmy.ml/c/pics but not in general, where I usually want text.

[–] [email protected] 2 points 1 year ago

This applies to any website. by visiting the website you give them your IP. the only way to mitigate this is to use a VPN.

[–] [email protected] 1 points 1 year ago

You can trust that I'm too incompetent to actually access that data in any meaningful way, but idk about some of you real tech knowers.

[–] [email protected] 1 points 1 year ago (2 children)

Is rhere anything end users can do about it, or is it a choice between using the fediverse or not using the fediverse?

[–] [email protected] -1 points 1 year ago

The Mullvad Browser. Think of it like the Tor Browser without Tor. That combined with Mullvad's VPN service would address both of the legitimate issues brought up in the OP.

[–] [email protected] -2 points 1 year ago (1 children)

At this point, raise awareness that it isn't like a major identifiable social media site who has a reputation to worry about. Right now, anyone can create a Lemmy instance and join the federation, there is no approval or application process.

[–] [email protected] 0 points 1 year ago (1 children)

I agree 100%, people need to know what they aare using and doing, especially less savvy or less curious users who wont seek out this kind of information on their own.

Im asking though, is their anything that can be done by the user themselves to obscure their IP when loading images, or is it just something that has to be accepted as part of using the fediverse if you want to use it, and thats just that.

[–] [email protected] -1 points 1 year ago* (last edited 1 year ago)

Some people use VPN... and every day they are getting a different IP address when they connect to their VPN...

It's normal, what's 'new' to people is that the images are loaded from peer. Especially coming from Reddit (where it uses thumbs.redditmedia.com), that is different from what most people expect. They assume you have to click a link to go off-site. "hotlinking" the images as Lemmy is typically doing right now involves more parties.

[–] [email protected] 1 points 1 year ago

Big instances surfing up content from smaller instances is invariably going to cripple them unless larger instances start locally caching that content.

[–] [email protected] 0 points 1 year ago

IP Address isn’t extremely precise, and I always run on the latest version of whatever browser I’m on, be it Safari or Edge.

[–] [email protected] 0 points 1 year ago (1 children)

I know very little about networks, but aren't end-users IP addresses dynamically assigned by their Internet providers? Don't providers use NAT systems so the public IP you see is not actually the one assigned to someone's "house"?

[–] [email protected] 0 points 1 year ago (1 children)

Don’t providers use NAT systems so the public IP you see is not actually the one assigned to someone’s “house”?

Typically NAT ends at the building. So a coffee shop it is going to use private addresses for every person on WiFi inside the coffee shop, but the servers are still going to get the single IP address of that building.

You can see what a typical database might say about your IP address: https://www.iplocation.net/ and compare with another service: https://iplocation.com/

[–] [email protected] 0 points 1 year ago* (last edited 1 year ago) (1 children)

Thanks, iplocation.net has a lot more detail than iplocation.com, but they both show exactly the same public IP for me (that is my provider), were they supposed to be different on the 2 sites?

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago)

hey both show exactly the same public IP

Your Public IP won't change, but the different databases guessing where that is, interpretation changes.

It was coincidence that they had similar names, I went through the first 5 ot 6 I found on a Google Search and picked two that had different actual information.

With the same IP, the first site thinks I am 2 states away in the USA (1300 miles wrong), the 2nd site shows exactly where I am. Almost all the sites show me 2 states away, but iplocation.com must have had someone identify the hotel I am at.

[–] [email protected] -1 points 1 year ago

Now that is purely passive, just data collection from routine serving of images.

A rogue site could start serving crafted images to confuse users or cause NSFW content to appear on all other Lemmy sites where users were browsing a meme.

When you have small-time image hosts being used by the dozens, they likely aren't as worried about their reputation being burned by pranks like this.