juuuuuust a thought...but....does AO verify file content of images in signatures? or in avatars? If I change my av to a linked image with a WMF file renamed to something else...where is the security there? I smell instant XSS amongs other fun tid-bits!

Soda, your ides is novel but won't work properly becuse IE tries to render the file if its been renamed aswell, so a gif/tif/png etc will all still render and exploit. This is thanks to MS's amazingly stupid idea of trying to be clever with error correction and try to assume that the file was named wrong. I have exploited IE machines by renaming a vbscript file to .png and it executed the commands without a hitch....well...not for me.

In sort, I see this as possably having a huge impact due to sneaky deployment on major sites.

- Noia