this post was submitted on 01 Oct 2023
8 points (100.0% liked)

Matrix

52 readers
4 users here now

An open network for secure, decentralized communication

founded 4 years ago
MODERATORS
[email protected]
8
Where are URL previews generated? (lemm.ee)
submitted 10 months ago* (last edited 10 months ago) by [email protected] to c/[email protected]
6 comments fedilink hide all child comments
 

I recently found that there is a room setting to enable the generation of URL previews. This makes me wonder, though: Who is generating the thumbnails? Does the server generate them, and then send the images back (this is an obvious privacy, and security vulnerability)? Does a user generate them locally, and send them to the other recipient (this is what Signal does)? Does the receiver generate them on their end (this is also a potential security vulnerability)?

EDIT (2023-10-01T21:38Z): I found this documentation which outlines the possible methods, but, from what I can see, it doesn't specify what one is actually used in practice. I was also unable to find any information in the Matrix spec.

EDIT (2023-10-01T21:41Z): In this set of release notes for Synapse 1.45.1, I found the following:

Note that URL previews are generated server-side, and thus generally disabled in encrypted rooms to avoid leaking information about message content to your homeserver. You may need to adjust the room's settings to see the new oEmbed previews.

If this is true, and all thumbnails are generated serverside, this is an enourmous security, and privacy risk.

EDIT (2023-10-01T22:18Z): Further research has found the following two open issues:

This confirms my suspicion -- at the very least, for Element (I have still been unable to find any official standardized method within the Matrix protocol). My PSA that I would provide, then, to any who are reading this, is to not enable thumbnail generation, as it is a major privacy, and security vulnerability.

top 6 comments
sorted by: hot top controversial new old
[–] [email protected] 3 points 10 months ago (1 children)

It's meta data in the Head tag of the web page. You can add descriptions and links to images. Some webpages can generate this data dynamically.

Basically a client application such as WhatsApp sees a url, and checks to see if the site has meta data and displays what it finds

[–] [email protected] 3 points 10 months ago* (last edited 10 months ago)

I was more referring to what entity is forming the request, not how the preview is generated from a technological standpoint.

I found this documentation which outlines the possible methods, but, from what I can see, it doesn't specify what one is actually used in practice. I was also unable to find any information in the Matrix spec.

[–] [email protected] 1 points 10 months ago (1 children)

What is the security/privacy flaw if the server does it? No point thinking a non-encrypted would be very secret in the first place.

I guess the idea is that this works with simpler clients as well. Other nessaging networks with initiator-side previews usually have single-provider clients, as far as I know.

Initiator-generated previews would be a nice feature, though, and they would work with e2ee.

[–] [email protected] 1 points 10 months ago (1 children)

What is the security/privacy flaw if the server does it? No point thinking a non-encrypted would be very secret in the first place.

What do you mean? Matrix supports E2EE.

I guess the idea is that this works with simpler clients as well. Other nessaging networks with initiator-side previews usually have single-provider clients, as far as I know.

I mean, it's up to the client to implement URL previews, anyways; if the client is simple, then the client wouldn't implement them. Unless you mean that the simple client should still provide other people that have non-simple clients URL previews, which would only be accomplished if the server generated them.

[–] [email protected] 1 points 10 months ago (1 children)

What do you mean? Matrix supports E2EE.

Its not used with e2ee, is it though? At least it's not the default and I doubt it can even be enabled.

So what is the security flaw assuming we weren't using e2ee to begin with?

Unless you mean that the simple client should still provide other people that have non-simple clients URL previews, which would only be accomplished if the server generated them.

Yes, like RSS bots, bridges, webhook-bots etc all can produce links the recipient might want to see previews for.

Another thing is that e.g. spammers might choose to use a misleading preview. Though I suppose that's a minor point, probably server-side previews can be tricked as well.

[–] [email protected] 1 points 10 months ago

Its not used with e2ee, is it though? At least it’s not the default and I doubt it can even be enabled.

It depends on what the defaults are for the client that you are using. Element, for example, defaults to E2EE.

Another thing is that e.g. spammers might choose to use a misleading preview. Though I suppose that’s a minor point, probably server-side previews can be tricked as well.

In my opinion this isn't a huge deal, but you do have a point in that it could be an attack vector for phishing.