Apparently there’s a vulnerability with sending messages with images in them and “she” might be logging people’s IP addresses through that.
If the images are hosted on your instance, this wouldn’t be relevant. If they’re links to an image hosted somewhere, this is possible, but there’d be a lot of noise and not much value. To link accounts to IPs the URLs would themselves need to be different
I checked the urls to the images in my PMs and they’re all hosted on Lemmy.
bamboo@lemmy.blahaj.zone 3 weeks ago
Every one of the posts today that I’ve received have the url
https://lemmy.laitinlok.com/pictrs/image/e1be7d9e-9e3e-4ba9-9c08-1ff084b554e1.png. If everyone has the same links, then logging people’s IP would get you the same information as logging IPs from a public post in any popular community. I think that would only make sense if each user was receiving different URLs, for the attacker to log the requested resource and their reference of which user they sent that URL to. I can’t confirm this suspicion on my own, but if the URL I posted is the same one you got today, then I doubt there’s any attempt to match users to their IP addresses.Rivalarrival@lemmy.today 3 weeks ago
The URL you posted is not what I received.
Some sort of deanonymizing and/or tracking is the only thing that makes sense here.
A VPN is called for.