An adventure-map maker and anyone who can use /give can obtain the IP addresses of all logged-in players. This is done by giving them player heads where the attacker's site is substituted for minecraft.net in the skin URL, which causes the game to make a traceable HTTP request to download the skin.
The only fix I can see for this is to give players an option to download or not download skins from non-Mojang sources. Unless and until a player opted in, they'd see the custom heads as Steve or Alex heads.
Linked issues
Comments 4
Like so:
/give @p skull 1 3 {SkullOwner:{Name:"SomeRandomName",Properties:{textures:[{Value:"eyJ0ZXh0dXJlcyI6eyJTS0lOIjp7InVybCI6Imh0dHA6Ly9tYWxsb3J5c2tpbi5hcHBzcG90LmNvbS9kZW1vIn19fQ=="}]}}}If you run the above code, I'll tell you the IP address you ran it from.
Fixed.
1.8.4
[19:50:42] [Server thread/INFO]: [@: Given [Magic Skull] * 1 to Kumasasa]
[19:50:42] [Client thread/ERROR]: Textures payload has been tampered with (non-whitelisted domain)
Can you give an example of how this would be used? I don't see how the site would be replaced with a different URL.