Agreed. For best security, images should be uploaded and/or cached/pulled from the bitcoin.org server before being displayed.
Not to mention image signatures are annoying as crap.
Topic: offsite profile image risks (Read 794 times)
+1
also links to external HTTP images break the lock icon in HTTPS connections
also links to external HTTP images break the lock icon in HTTPS connections
When viewing this thread..
http://forum.bitcoin.org/index.php?topic=21052.0;topicseen
..I got an HTTP login prompt, apparently because the page was trying to display this image from someone's profile..
http://pool.bloodys.com/?action-userbar&cmd=2a8ca8960d59854f4e04b1963161b766.png
An unsophisticated user might enter their forum.bitcoin.org credentials into that prompt.
More generally, loading offsite images is an information leak (IP addresses of forum readers) and possibly even security risk (if any browser image-handling flaw would let the source site do more, such as redirect to some other site'sXSS CSRF flaw, run JS, or in a worst-case, buffer-overflow for local code execution).
I suggest in our new security-conscious era, loading of offsite images as profile icons be disabled.
http://forum.bitcoin.org/index.php?topic=21052.0;topicseen
..I got an HTTP login prompt, apparently because the page was trying to display this image from someone's profile..
http://pool.bloodys.com/?action-userbar&cmd=2a8ca8960d59854f4e04b1963161b766.png
An unsophisticated user might enter their forum.bitcoin.org credentials into that prompt.
More generally, loading offsite images is an information leak (IP addresses of forum readers) and possibly even security risk (if any browser image-handling flaw would let the source site do more, such as redirect to some other site's
I suggest in our new security-conscious era, loading of offsite images as profile icons be disabled.
Jump to: