Brickadia - 3 Months later

Queuenard

zombie_striker Discord is great for playing games and chilling with friends, or even building a worldwide community. Customize your own space to talk, play, and hang out.

What's up with this embed? Who wrote the embed system? It directly queries discordapp.com for the image, exposing every visitor's IP address to discordapp.com. It's only the IP address (seemingly not cookies) but in households that can expose a lot. Even if discordapp.com is not a problem, this has bigger implications for other remote websites.

DingoAnanas

Queuenard Did someone make a discord thing for brickadia or i am wrong?

zombie_striker

Queuenard
Holy shit thats fucked up. I just copied the link to share it. I did not know it would leak that info EVERY TIME a user clicks the webpage.

I would have assumed it would just by loaded once and cached by brickadia.org, and be done with. Continual pinging to discord? Thats fucky bad coding.

Queuenard

DingoAnanas

zombie_striker
Just to be clear it's only discordapp.com (not discord.com) but of course that could become a redirect at any time. The referer sent by my browser to request the image was forum.brickadia.org (no further path information) so that's better.

It's an ancient problem on forums. Now imagine I embedded an innocent image from brickadia.com and now they can see the IP address of everyone who opens this page.

If you embed an image using "Add an image" it appears to be the same issue. (I posted an image for a second)

« Previous Page