8 ms·

Tell HN: Every photo in Facebook is somewhat publicly accessible

43 points by skbohra123 16y ago

Facebook generates a static url for each photo you upload. Regardless of what your privacy settings are, anyone can access that photo if he knows url of that photo. I don't think that this should be the ideal behaviour? I tried changing my privacy settings such that photos I am tagged in, should be visible to 'only me', but regardless of this, anyone who knows this url can see this photo. I think this is a big privacy leak issue, or am I missing some point ?

jhuckestein 16y ago
I have a house in the woods and never lock the door because nobody knows where it is anyway! What's the problem? This is definitely not an ideal setup, but it's hard to improve. The only solution I can think of is having an application server serve the pictures after authenticating the request. The picture servers would need to be connected to some sort of database to do that. Serving a single image would incur multiple times the current cost.
- bbatsell 16y ago
  > The only solution I can think of is having an application server serve the pictures after authenticating the request. Or, make the URL fbcdn.com/p/timestamp/hash of internal salt + timestamp/unique ID.jpg. If the timestamp isn't from within the past 2 minutes, don't serve the image. Almost every static server offers this as a plugin, and it doesn't need to touch a database. AWS offers something similar as a time-limited "access key".
  - chopsueyar 16y ago
    Nice idea.
    - parfe 16y ago
      Right Click, Save Image As... Post to imgur. How would this change be any different? And a better question is, why bother?
      - chopsueyar 16y ago
        Not sure why you are hating on ideas to mitigate this from occuring.
- kree10 16y ago
  But people can see your house in the woods. I think it's more like: see that forest out there? In one of those trees, I drilled a hole in the trunk and stuck a rolled-up $100 bill in it. Even though I told you it's out there, good luck finding it, unless I tell you which tree.
  - joezydeco 16y ago
    Unless I rent a bloodhound for an afternoon for $50...
    - kree10 16y ago
      All right, I'll give you that. But what if your "reward" was not $100 but a photo of an unknown subject. There's a small chance that photo is something you find valuable (newsworthy, embarrassing to the subject, etc.), but there's a far better chance it's a scene from a toddler's birthday party taken on a bad cell phone camera. That's closer to what Facebook is doing. I wouldn't rent a bloodhound for that.
dangrover 16y ago
I think it's pretty safe as long as no one without the permissions can find (or guess/extrapolate) that URL. The images are probably just hosted by a CDN and serving up the files with authentication might slow it down or complicate the setup.
- skbohra123 16y ago
  So, this is the ideal way to host static files? I think this is something like a pseudo security, isn't it? What we call is 'ostrich' approach to security. There must be some better way to do this.
  - tptacek 16y ago
    Requiring attackers to guess a 128 bit random number (actually, fbcdn seems to use 136 bit random numbers) isn't "psuedo" security.
    - thomas11 16y ago
      The problem is that the random number is static. As Aegan says, anyone allowed to see a photo can leak its URL. It would be better if the URL would depend on the user to whom the picture is served. But that'd be expensive.
      - tptacek 16y ago
        Anyone allowed to see a photo can leak the photo. Why waste time protecting the ID?
        thomas11 16y ago
        Sure, in practice there's not much of a difference, I'm nitpicking, but it's not exactly the same thing. People might leak the URL unintentionally, for instance by sending the link to others, not knowing that the photo owner doesn't want them to see the photo. One can also use URLs in places where images are not allowed, for example when submitting them to community websites, without first uploading the photo somewhere and leaving a trail.
DVassallo 16y ago
The same thing happens in Picasa Web Albums. Photos in private albums are still accessible if the URL to the jpg image is known. The situation in Picasa is quite particular, since you get to choose between three visibility options when an album is created: - Public - Anyone with the link - Private The "Anyone with the link" option means that Picasa generates a "difficult to guess" URL for the whole album. That's fine and well documented, but the "Private" option might imply that anyone with the link won't be able to access individual photos, which is not the case. I'm afraid users might feel that their photos are hidden as much as emails are in GMail, for example.
Terretta 16y ago
Flickr changes a photo's URLs any time you adjust the privacy settings. Downside: toggling privacy breaks links to the photo. Upside: toggling privacy breaks links to the photo.
tptacek 16y ago
No, they aren't. Every photo in Facebook is accessible if you know the its secret photo ID, which is an unguessably large random number. It's not completely optimal that Facebook embeds secrets in URLs this way (for example, if you browse directly to a photo via its fbcdn URL, you'll have planted the secret in your browser history). But it's a common industry practice, and since it's used on URLs that shouldn't normally end up in your browser history, it's hard to see the major problem with it. So yes, you're missing a major point, and you haven't found a big privacy leak. Sorry.
- skbohra123 16y ago
  A secret Id that every user you have shared the photo with knows and hence can publish them ? Uh.
  - tptacek 16y ago
    The photograph itself is just a larger and less random number that can also be published.
  - laskito 16y ago
    Your "friend" can download the photo and publish it somewhere else, open for everyone.
    - borism 16y ago
      why, if you can simply hotlink to facebook cdn?
      - tptacek 16y ago
        Leaking photos by publishing fbcdn links is worse for attackers on every axis than simply stealing and reposting the photo: * The leaker and the viewers are more traceable, since they're hitting Facebook's servers * Facebook can cut off access to the photos by reassigning the IDs * To get the actual link, you have to dig into the Facebook page source; to get the photo, you just have to right-click on it. This is a stupid, silly threat to worry about. Unless you find a way to predict fbcdn URLs, there's nothing overtly wrong with what Facebook is doing. Plenty of sites rely on the same technique to protect significantly more sensitive information.
sgibat 16y ago
Many people are aware of this. It's been convenient so many times when needing to show a picture of some cute girl to my friends!
naner 16y ago
This is for convince so people can easily share private photos. It is a usability trade-off.
- statictype 16y ago
  hm, not quite. It's done this way because running code to authenticate+authorize the user before serving up an image incurs a much higher performance hit than just shoveling the bits directly off a disk. Especially when those bits can come from a content delivery network. Facebook handles a ridiculously large number of photos - probably an order of magnitude more than any other site - so this trade off, I would guess, is pretty crucial to keeping the site up.
venturebros 16y ago
If you want to see photos of someone with a private account just find the name of someone on their list that has an open facebook account. Look through their wall (or whatever) and if you see them commenting on the persons photo just click that. You will not only see the photo but all the photos the album is housed in. Much faster than trying to figure out URLs.
- ErrantX 16y ago
  YMMV over this; sometimes it works sometimes it doesn't. If the album owner is really locked down you can only see the photo commented on (I think it depends on whether you allow sharing with "friends of friends" or just "friends").
AndrewMoffat 16y ago
Equivalent headline: "Tell HN: Every encrypted message is somewhat publicly accessible* *if you guess the key/password"
- statictype 16y ago
  Every photo is publicly accessible. It's just not easily discoverable. I agree, though, that this is mostly a non issue.
- cjg 16y ago
  The difference is that keys and passwords are managed in a more careful way (think encrypted key stores), whereas URLs are not handled with the same care. Apart from that, I agree with you.
djhworld 16y ago
I've had a a few instances of a mate sending me a link to photos of people of whom I'm not friends with. So I agree that this is of a concern
- statictype 16y ago
  They could just copy the photo and email that you. No amount of privacy code on FB's servers are going to be able to prevent that.
  - chopsueyar 16y ago
    Well, then they should only display it through a Flash app.
    - smokinn 16y ago
      Screenshot. Once it's been transmitted the end user has full control. (Which is why DRM constantly fails)
      - chopsueyar 16y ago
        Taking a screenshot, then cropping it, is a fundamentally different process. As one of the other commentors mentioned, the static url was a good way for him to share with his other mates, via chat, pictures of pretty girls. Taking a screenshot, cropping it, saving it locally, then uploading it to some host, and then finally emailing or IMing the link. That is not a really easy process to share with his mates. For clarification, my previous comment was directed at statictype's reply to djhworld: "No amount of privacy code on FB's servers are going to be able to prevent that." statictype referring to "that" as "They could just copy the photo and email that you." By displaying the image in Flash, it eliminates the possibility of simply sending a URL, and instead, requires the process mentioned above. No more sending your mate URLs of pretty girls.
ErrantX 16y ago
Random thought; you could make use of this as "free" image CDN (probably against the TOS but useful nonethless :))
- chopsueyar 16y ago
  Another nice idea.
- pclark 16y ago
  I imagine Facebook photos get so much traffic they wouldn't even notice.
bhiller 16y ago
I have found another security hole: When viewing a photo, you can take a screenshot of it and upload it to anywhere else on the internet, where any arbitrary person can see it. This violates all of my expectations of privacy.
juanito 16y ago
Another fun fact: Even if you delete a photo from an album, Facebook doesn't get rid of it immediately. I know this because I was able to retrieve a photo that I'd seen in someone's album, a day after it had been removed from that album, by retrieving the image url in my browser history.
rryyan 16y ago
A related issue here is what happens when a user deletes a photo -- there is a lag time between the delete action and the CDN being updated. Deleted photos are still available via the direct image URL while the CDN is out of sync. As of July 2009 [1], the lag time was at least 2 months. So if the URL has been shared, access to the image may not be easily revoked. [1] http://arstechnica.com/web/news/2009/07/are-those-photos-really-deleted-from-facebook-think-twice.ars http://arstechnica.com/web/news/2009/07/are-those-photos-rea...
known 16y ago
I think photos are accessible in http://youropenbook.org/ http://youropenbook.org/
wiks 16y ago
When i noticed it, I was freaked out for a while. I thought that is the same with the case of facebook videos but turned out it said,"This video either had been removed from Facebook or is not visible due to privacy settings." I Guess they should do the same with the photos too.
alastair 16y ago
Also worth mentioning that the image name / url isn't enterly random - it contains the profile ID of the owner. This means the reverse situation to the one mentioned in the OP is possible, where a linked photo can be traced back to the person's profile. This is pretty well known but I havn't seen it mentioned in this thread yet.
nl 16y ago
It's actually worse than that. If you know the URL of the photo you can regenerate the url of the page it is on (and possibly see the gallery it is in) and the url of the profile it came from.

43 points by skbohra123 16y ago

jhuckestein 16y ago

I have a house in the woods and never lock the door because nobody knows where it is anyway! What's the problem? This is definitely not an ideal setup, but it's hard to improve. The only solution I can think of is having an application server serve the pictures after authenticating the request. The picture servers would need to be connected to some sort of database to do that. Serving a single image would incur multiple times the current cost.

bbatsell 16y ago
> The only solution I can think of is having an application server serve the pictures after authenticating the request. Or, make the URL fbcdn.com/p/timestamp/hash of internal salt + timestamp/unique ID.jpg. If the timestamp isn't from within the past 2 minutes, don't serve the image. Almost every static server offers this as a plugin, and it doesn't need to touch a database. AWS offers something similar as a time-limited "access key".
- chopsueyar 16y ago
  Nice idea.
  - parfe 16y ago
    Right Click, Save Image As... Post to imgur. How would this change be any different? And a better question is, why bother?
    - chopsueyar 16y ago
      Not sure why you are hating on ideas to mitigate this from occuring.
kree10 16y ago
But people can see your house in the woods. I think it's more like: see that forest out there? In one of those trees, I drilled a hole in the trunk and stuck a rolled-up $100 bill in it. Even though I told you it's out there, good luck finding it, unless I tell you which tree.
- joezydeco 16y ago
  Unless I rent a bloodhound for an afternoon for $50...
  - kree10 16y ago
    All right, I'll give you that. But what if your "reward" was not $100 but a photo of an unknown subject. There's a small chance that photo is something you find valuable (newsworthy, embarrassing to the subject, etc.), but there's a far better chance it's a scene from a toddler's birthday party taken on a bad cell phone camera. That's closer to what Facebook is doing. I wouldn't rent a bloodhound for that.

dangrover 16y ago

I think it's pretty safe as long as no one without the permissions can find (or guess/extrapolate) that URL. The images are probably just hosted by a CDN and serving up the files with authentication might slow it down or complicate the setup.

skbohra123 16y ago
So, this is the ideal way to host static files? I think this is something like a pseudo security, isn't it? What we call is 'ostrich' approach to security. There must be some better way to do this.
- tptacek 16y ago
  Requiring attackers to guess a 128 bit random number (actually, fbcdn seems to use 136 bit random numbers) isn't "psuedo" security.
  - thomas11 16y ago
    The problem is that the random number is static. As Aegan says, anyone allowed to see a photo can leak its URL. It would be better if the URL would depend on the user to whom the picture is served. But that'd be expensive.
    - tptacek 16y ago
      Anyone allowed to see a photo can leak the photo. Why waste time protecting the ID?
      - thomas11 16y ago
        Sure, in practice there's not much of a difference, I'm nitpicking, but it's not exactly the same thing. People might leak the URL unintentionally, for instance by sending the link to others, not knowing that the photo owner doesn't want them to see the photo. One can also use URLs in places where images are not allowed, for example when submitting them to community websites, without first uploading the photo somewhere and leaving a trail.

DVassallo 16y ago

The same thing happens in Picasa Web Albums. Photos in private albums are still accessible if the URL to the jpg image is known. The situation in Picasa is quite particular, since you get to choose between three visibility options when an album is created: - Public - Anyone with the link - Private The "Anyone with the link" option means that Picasa generates a "difficult to guess" URL for the whole album. That's fine and well documented, but the "Private" option might imply that anyone with the link won't be able to access individual photos, which is not the case. I'm afraid users might feel that their photos are hidden as much as emails are in GMail, for example.

Terretta 16y ago

Flickr changes a photo's URLs any time you adjust the privacy settings. Downside: toggling privacy breaks links to the photo. Upside: toggling privacy breaks links to the photo.

tptacek 16y ago

No, they aren't. Every photo in Facebook is accessible if you know the its secret photo ID, which is an unguessably large random number. It's not completely optimal that Facebook embeds secrets in URLs this way (for example, if you browse directly to a photo via its fbcdn URL, you'll have planted the secret in your browser history). But it's a common industry practice, and since it's used on URLs that shouldn't normally end up in your browser history, it's hard to see the major problem with it. So yes, you're missing a major point, and you haven't found a big privacy leak. Sorry.

skbohra123 16y ago
A secret Id that every user you have shared the photo with knows and hence can publish them ? Uh.
- tptacek 16y ago
  The photograph itself is just a larger and less random number that can also be published.
- laskito 16y ago
  Your "friend" can download the photo and publish it somewhere else, open for everyone.
  - borism 16y ago
    why, if you can simply hotlink to facebook cdn?
    - tptacek 16y ago
      Leaking photos by publishing fbcdn links is worse for attackers on every axis than simply stealing and reposting the photo: * The leaker and the viewers are more traceable, since they're hitting Facebook's servers * Facebook can cut off access to the photos by reassigning the IDs * To get the actual link, you have to dig into the Facebook page source; to get the photo, you just have to right-click on it. This is a stupid, silly threat to worry about. Unless you find a way to predict fbcdn URLs, there's nothing overtly wrong with what Facebook is doing. Plenty of sites rely on the same technique to protect significantly more sensitive information.

sgibat 16y ago

Many people are aware of this. It's been convenient so many times when needing to show a picture of some cute girl to my friends!

naner 16y ago

This is for convince so people can easily share private photos. It is a usability trade-off.

statictype 16y ago
hm, not quite. It's done this way because running code to authenticate+authorize the user before serving up an image incurs a much higher performance hit than just shoveling the bits directly off a disk. Especially when those bits can come from a content delivery network. Facebook handles a ridiculously large number of photos - probably an order of magnitude more than any other site - so this trade off, I would guess, is pretty crucial to keeping the site up.

venturebros 16y ago

If you want to see photos of someone with a private account just find the name of someone on their list that has an open facebook account. Look through their wall (or whatever) and if you see them commenting on the persons photo just click that. You will not only see the photo but all the photos the album is housed in. Much faster than trying to figure out URLs.

ErrantX 16y ago
YMMV over this; sometimes it works sometimes it doesn't. If the album owner is really locked down you can only see the photo commented on (I think it depends on whether you allow sharing with "friends of friends" or just "friends").

AndrewMoffat 16y ago

Equivalent headline: "Tell HN: Every encrypted message is somewhat publicly accessible* *if you guess the key/password"

statictype 16y ago
Every photo is publicly accessible. It's just not easily discoverable. I agree, though, that this is mostly a non issue.
cjg 16y ago
The difference is that keys and passwords are managed in a more careful way (think encrypted key stores), whereas URLs are not handled with the same care. Apart from that, I agree with you.

djhworld 16y ago

I've had a a few instances of a mate sending me a link to photos of people of whom I'm not friends with. So I agree that this is of a concern

statictype 16y ago
They could just copy the photo and email that you. No amount of privacy code on FB's servers are going to be able to prevent that.
- chopsueyar 16y ago
  Well, then they should only display it through a Flash app.
  - smokinn 16y ago
    Screenshot. Once it's been transmitted the end user has full control. (Which is why DRM constantly fails)
    - chopsueyar 16y ago
      Taking a screenshot, then cropping it, is a fundamentally different process. As one of the other commentors mentioned, the static url was a good way for him to share with his other mates, via chat, pictures of pretty girls. Taking a screenshot, cropping it, saving it locally, then uploading it to some host, and then finally emailing or IMing the link. That is not a really easy process to share with his mates. For clarification, my previous comment was directed at statictype's reply to djhworld: "No amount of privacy code on FB's servers are going to be able to prevent that." statictype referring to "that" as "They could just copy the photo and email that you." By displaying the image in Flash, it eliminates the possibility of simply sending a URL, and instead, requires the process mentioned above. No more sending your mate URLs of pretty girls.

ErrantX 16y ago

Random thought; you could make use of this as "free" image CDN (probably against the TOS but useful nonethless :))

chopsueyar 16y ago
Another nice idea.
pclark 16y ago
I imagine Facebook photos get so much traffic they wouldn't even notice.

bhiller 16y ago

I have found another security hole: When viewing a photo, you can take a screenshot of it and upload it to anywhere else on the internet, where any arbitrary person can see it. This violates all of my expectations of privacy.

juanito 16y ago

Another fun fact: Even if you delete a photo from an album, Facebook doesn't get rid of it immediately. I know this because I was able to retrieve a photo that I'd seen in someone's album, a day after it had been removed from that album, by retrieving the image url in my browser history.

rryyan 16y ago

A related issue here is what happens when a user deletes a photo -- there is a lag time between the delete action and the CDN being updated. Deleted photos are still available via the direct image URL while the CDN is out of sync. As of July 2009 [1], the lag time was at least 2 months. So if the URL has been shared, access to the image may not be easily revoked. [1] http://arstechnica.com/web/news/2009/07/are-those-photos-really-deleted-from-facebook-think-twice.ars http://arstechnica.com/web/news/2009/07/are-those-photos-rea...

known 16y ago

I think photos are accessible in http://youropenbook.org/ http://youropenbook.org/

wiks 16y ago

When i noticed it, I was freaked out for a while. I thought that is the same with the case of facebook videos but turned out it said,"This video either had been removed from Facebook or is not visible due to privacy settings." I Guess they should do the same with the photos too.

alastair 16y ago

Also worth mentioning that the image name / url isn't enterly random - it contains the profile ID of the owner. This means the reverse situation to the one mentioned in the OP is possible, where a linked photo can be traced back to the person's profile. This is pretty well known but I havn't seen it mentioned in this thread yet.

nl 16y ago

It's actually worse than that. If you know the URL of the photo you can regenerate the url of the page it is on (and possibly see the gallery it is in) and the url of the profile it came from.