Maybe it's me, but this is really, really bad. Probably because I come from an IRC background.

I had assumed these request were proxified, but I didn't realise that would go against E2E. Now I'd like to see an option to disable these previews.

The way Apple iMessages does this is to have the user opt-in to each preview (it shows a grey box with a button to build a preview).

Not much different if users learn to always tap to generate the preview out of habit.

Yes, but you get the benefit of getting to see the domain before deciding whether you want to show a preview.

You’d think that someone with an IRC background would expect this, rather than be shocked by it.

I'm shocked that something this obvious has not been worked around.

I don’t get the problem... it discloses the IP of each user to themselves, no? In that case what’s the point?

I send you a link to my server you don’t need to click on it for me to know your IP.

That said there isn’t a very good solution for this.

Link preview is a user requested feature they can’t disable it.

Doing link previews on the backend would expose what you share to W/A which ain’t good either.

The only remotely viable option is that the sender must generate the link preview and then they send it but then that can be potentially exploited for other things.

If you send me a link you create the preview and your address is disclosed. This is a non issue.

The reply is generated by the server in question, using information available to it.

Essentially, the point here is that WhatsApp is "clicking" the link (to generate a preview) with a resulting connection from the client's device, without user interaction.

So you can send a link to a server you control and harvest the recipient's client device IP, without the need for them to click on it.

Ok, I get it, sorry. The way it was described, looked like a problem in the chat flow

Isn't there a workaround that they could load the preview on the server side?

So you rather W/A know what you are sharing? That kinda violates the whole point of E2E if you start putting in exceptions.

A better workaround would be the sender generating a preview but even that has a few threat models that can be abused.

Oh yea, good point

it's to use Tor