Prevent password theft through a picture on another site

Question

User identification

Colleagues, tell me how you can protect yourself from such a user attack:
A picture from your site is inserted into a blog on a 2.0 site. After a while, the picture is closed by http-authorization. As a result, a user who comes to read this blog post will have an authorization window in which he will happily enter a password. Okay, you can't catch a geek like that, but most users will.

I see the following options:
- prohibit external images - bad
- make the authorization form on the site in a very different design so that the user does not get confused
- add the onerror="return false" attribute to each image of the external site - the question is when it will be called - on the first 401 or after 3 failed attempts
- preloading all images in JS with verification and only after that showing - an example on prototype

What do you advise? What if JS doesn't work?

UPD from the comments: you can cache pictures at home, then they will definitely be good. But: traffic, copyright.

Answer 1

- Educate site users by displaying an informative warning next to the login form.
- Lobby among browser developers for the idea of ​​disabling by default the display of HTTP authorization dialogs related not to the page itself, but to embedded resources.

Answer 2

This is how you can avoid the hole www.daveoncode.com/2010/08/20/image-background-fallback-img-tag-error-handlers/

Answer 3

While I see such a solution - make a preloader based on an example, and in all pictures write something like this
[img src="javascript: load('http://evil-host/world-evil.png')" /] and in this function upload the image and put it in the right place. Yes, don't forget to remove lowsrc from the attributes. I hope everyone remembers him. :)

Answer 4

list of allowed hostings with regular validation of their urls.
cons:
maybe true

Answer 5

Sorry.
List of allowed hostings with regular validation of their urls.
disadvantages:
- you need to follow the updates
- hosting can break
- users may not like the restriction

Answer 6

Alternatively, you can download the picture not immediately, but after contacting this address from the server, while analyzing the response code, but not downloading the content itself. I'm not really sure how technically this can be implemented, and whether it is possible at all.