Edge sends images you view online to Microsoft

Re:Edge sends images you view online to Microsoft by Terr_ on Monday June 12, 2023 @08:12PM (#36303285)

Even if the payload is inaccessible, consider the implications of leaking an URL like:

medical-intranet.example.com/uploads/secure_link/adc83b19e793491b1c6ea0fd8b46cd9f32e592fc/john_doe_1987-04-23_chlamydia_1.jpg

[ Parent | on HN ]

Re:Edge sends images you view online to Microsoft by dhx on Monday June 12, 2023 @11:43PM (#36304938)

And what prevents a distributed denial of service attack or fuzzing using Microsoft's infrastructure? If you were to trick many users into visiting a site with 1000 variants of:

  <img src="https://siteunderattack.com/api/computationally-expensive-function/?image=cute_bunnies_####.jpg"/>

  <img src="https://siteunderattack.com/api/function123/?name=Robert'); DROP TABLE students;--&image=cute_bunnies_####.jpg"/>

[ Parent | on HN ]

Re:Edge sends images you view online to Microsoft by kevincox on Tuesday June 13, 2023 @06:56AM (#36308302)

This is really no different than having the client do the request without the Microsoft proxy.

[ Parent | on HN ]