Hacker News Reader

WhatsApp has an option to disable link previews.

Surprised signal doesn't have this option.

I only message people I know on Signal anyway.

Edit: it seems signal does have the option

I had this same thought before reading the article - this isn't about link previews, it's about attachment caching

But previewing can involve automatically loading resources. This "attack" is very similar to CSRF in that your exploit involves making the victim load a specific resource. That's why in secure mail clients, nothing but plaintext should be rendered, and an optional "Load all resources" button is shown for when you trust the sender, and want to load any media elements that require HTTP onto your client.

Signal could mitigate this with something similar, where it didn't load the image file AT ALL, and instead showed a message:

<User> wants you to load an image from https://example.com/foo.png. Load image? > Yes > No

The difference being is that it's not a resource controlled by the attacker, it's an attachment hosted by Signal. But yes, removing previews for everything would mitigate the issue.

Reply on news.ycombinator.com