OdyseeTeam / odysee-frontend

The code that runs odysee.com
https://odysee.com
MIT License
216 stars 68 forks source link

Embedding images without proxy is probably not in compliance with data protection regulations in Germany/Europe (GDPR) #536

Closed Abwasserrohr closed 2 years ago

Abwasserrohr commented 2 years ago

Is your feature request related to a problem? Please describe. Embedded images should run through a proxy to protect the ip address of the user.

Why this can be a problem

  1. GDPR regulations in Europe
  2. Thrid parties like exploitative lawyers can go after Odysee users, happened already on other sites, they upload honeypots and then send fines to people using their ip.
  3. Hackers could get the ip of the creators or their fans and DDoS them or get more info with the ip.

Describe the solution you'd like Like the thumbnails, also proxy all images. Before:

https://api.skyroad.me/helloworld.php

After:

https://thumbnails.odysee.com/optimize/s:0:0/quality:85/plain/https://api.skyroad.me/helloworld.php

Hive also does this, they have some repos with functions that do something like that to protect the ip: https://github.com/mahdiyari/hive-content-renderer

Additional context Anyone with enough LBC can either just get my ip by posting a comment with the picture or posting a blogpost with a image can also just leak my ip. By GDPR, the ip has to be protected, like the name, address or other personal information of the user.

getting-ip

tzarebczan commented 2 years ago

Thanks for the feedback, we should be able to do handle this.

tzarebczan commented 2 years ago

We can do this now with thumbnails.odycdn.com

Abwasserrohr commented 2 years ago

I don't know how this could be prevented, but it would be great if iframes for html could be covered somehow. Example: https://odysee.com/@Abwasserrohr:f/test-html:e If not possible, some kind of warning would be great, before the data is loaded.

infinite-persistence commented 2 years ago

Pending https://odysee-workspace.slack.com/archives/C02P8NNBFH7/p1642559739003600

Abwasserrohr commented 2 years ago

It would be cool if it passes apng, webp and gif through, so they're animated.

Example:

tzarebczan commented 2 years ago

This should be working now.