I recently found that there is a room setting to enable the generation of URL previews. This makes me wonder, though: Who is generating the thumbnails? Does the server generate them, and then send the images back (this is an obvious privacy, and security vulnerability)? Does a user generate them locally, and send them to the other recipient (this is what Signal does)? Does the receiver generate them on their end (this is also a potential security vulnerability)?

EDIT (2023-10-01T21:38Z): I found this documentation which outlines the possible methods, but, from what I can see, it doesn’t specify what one is actually used in practice. I was also unable to find any information in the Matrix spec.

EDIT (2023-10-01T21:41Z): In this set of release notes for Synapse 1.45.1, I found the following:

Note that URL previews are generated server-side, and thus generally disabled in encrypted rooms to avoid leaking information about message content to your homeserver. You may need to adjust the room’s settings to see the new oEmbed previews.

If this is true, and all thumbnails are generated serverside, this is an enourmous security, and privacy risk.

EDIT (2023-10-01T22:18Z): Further research has found the following two open issues:

This confirms my suspicion – at the very least, for Element (I have still been unable to find any official standardized method within the Matrix protocol). My PSA that I would provide, then, to any who are reading this, is to not enable thumbnail generation, as it is a major privacy, and security vulnerability.

  • Flyberius [comrade/them]@hexbear.net
    link
    fedilink
    English
    arrow-up
    3
    ·
    1 year ago

    It’s meta data in the Head tag of the web page. You can add descriptions and links to images. Some webpages can generate this data dynamically.

    Basically a client application such as WhatsApp sees a url, and checks to see if the site has meta data and displays what it finds

    • Kalcifer@lemm.eeOP
      link
      fedilink
      arrow-up
      3
      ·
      edit-2
      1 year ago

      I was more referring to what entity is forming the request, not how the preview is generated from a technological standpoint.

      I found this documentation which outlines the possible methods, but, from what I can see, it doesn’t specify what one is actually used in practice. I was also unable to find any information in the Matrix spec.