EVE General Discussion

Code wise it's impossible to tell if an URL points to a static image or a server side script file, making it impossible to detect the real origin of the data transmitted to the user. Some forums utilize some simple file name matching (e.g. forcing the file name to end with ".png" or ".jpg"). However this isn't any real secure solution at all as it will only block very simple attempts. It takes less than a minute to write server side code that will be requested using something like http://example.com/static_image.jpg. On the first look this might appear to be a static JPEG image. However it could be anything, it could essentially be some script retrieving the page you're looking at and rendering it to an image (or doing more nasty things like trying to peek on the page's URL and/or cookies and/or trying to exploit some browser or image filter vulnerability.

indeed you are correct. but how has this changed since yesterday. eg on the old forum where you could link images.

It didn't change - but the old forums were on http only anyway. It's more like an improvement: Why switching to HTTPS while keeping the images back door open?

Days, I don't want to sound bitter here because I kinda like the new forums although they lack some basic functionality at the moment.
Days is being very optimistic considering how long they have been working on this thing so far. I had not pegged you for an optimist Jade.

By this exact logic you are now saying that remote scripting exploits WERE possible on the previous iteration of this forum, despite your explicit claims that the opposite was true.

Please resolve this logical fallacy for me?

No, (despite the mentioned possible client side exploits) I'm talking about server side code that's run when the image is requested. Depending on your browser it will send quite a few lines of information, including referral information and such. It's the way classic non-JavaScript stats tracking scripts work. This not only opens up possible exploits (it's not like you need only 5 minutes and you've got something to explot - let's be honest) but also privacy issues (e.g. in Germany some instances actually want to force the removal of facebook's "I like" buttons due to them collecting data just by being embedded into the pages). I know that most abusive stuff will require at least some JavaScript code, but it's possible to get quite some data utilizing simple HTTP requests, e.g. for images.

My apologies for the confusion of terminology. I meant embedded images of course. I'm not that keen on the warning message for external links myself - quite immersion-breaking.



Okay that makes sense certainly. Have you considered the alternative I mentioned above about hosting a ccp-controlled image upload service for signatures and in-character imagery and allowing people to embed directly from the ccp secure webserver?



Would it be possible for you to ask the forum producer to come and give a response to this thread when he gets a spare minute?

If you are referring to the short period where we did allow signatures on the first (failed) attempt at launching these forums then yes, it was a possibility. But it is a pretty remote possibilty, and this possibility exists on pretty much all public forums that do allow external image linking.
I'd like to underline that this is a remote possibility, and (known) flaws like these have been fixed in all modern browsers.

But like I stated in my previous reply this isn't the only concern. Some browsers give you a warning if you try to request non-https images from a https website (for a good reason too).

Privacy is a concern too. Example: By hosting an image on my own webserver and putting it in my signature on forums, I can get a pretty good picture of the usage of that forum and where people using it are from.. as well as log IP addresses etc.
I don't want to scare people, but do you want RMT tracking your IPs?

Please correct me if I'm wrong, but as far as I know you cannot embed images in your posts either.



Yes, that is one of the options being considered.

No it's not impossible, can be server intensive ? yes it can, does the increase in server usage compensate the added feature ? No I don't think it does.



This is what I thought first as being the initial concern seeing the forums are being run under https, and this yes, concerns me alot more than the checking or not what the external url is since it can be used easily to generate man in the middle attacks.

Advice ? simple, add the ability to upload images into your forum account with a very very low diskspace limit (something like 150k ?! 'ought to be enough' like our dear Gates once said) and use that for avatar/signatures.