11 ms·

This is exactly what I, and everyone else I know, wants to happen when you share a link to a photo. Do we not remember what the alternative is? Sharing with som

by pkulak 7y ago

This is exactly what I, and everyone else I know, wants to happen when you share a link to a photo. Do we not remember what the alternative is? Sharing with someone's Google account, I suppose? Oh, but now when you send that link to your iMessage group, you have to know every one's Google account name. And then half of them will be logged into their work accounts (or not logged in) at the time and it will fail, and the whole message thread turns into a discussion of how 3/4 of the people can't see the photo. What are the easier alternatives? Emailing maybe? But then you've moved the bits into someone else's account and they are there forever and can be forwarded anywhere. Maybe print a physical copy? Then that copy is around forever and can be handed to anyone else. They only extra security I would tolerate is an optional expiration, defaulted to a year or so. I love taking photos, I enjoy sharing them, and it's important to me to keep that simple and accessible. I think of these share links as bearer auth, which is used all over the web and is a perfectly valid way to secure a resource.

DominikPeters 7y ago
Why not do it exactly like Drive, where you can choose between sharing by link, or sharing with Google accounts?
- pkulak 7y ago
  Well, you can already share photos with other Google accounts. It's even the default. You have to specifically click the "Create Link" button on the share page to do differently.
  - sp332 7y ago
    That is not what happens in the video.
  - DominikPeters 7y ago
    In Photos, it looks like you can choose between the two, but actually sharing to a Google account also creates a link without making it explicit.
    - pkulak 7y ago
      Oh, I see what you mean. It looks like if the person you share to doesn't use Photos, they get a link sent by email. It takes a pretty deep understanding to avoid sending a link.
    - chaosite 7y ago
      It doesn't matter if the person you're sharing with is using Photos or not. Either way, a link is created, and you can access it without being logged in to a Google Account at all.
  - chaosite 7y ago
    No, that's wrong, and that's the thing that's surprising here. If you share with a Google account a globally shareable link is created and is emailed to the person.
- ehsankia 7y ago
  And then you get dozens of email from every friend requesting access to the photo, which you have to manually approve? Might work nicely for a document, but that would be a really shitty UX for sharing photos with friend group and relatives.
  - lukeschlather 7y ago
    Why not do it like Facebook and make it totally impossible to turn a private photo into a public link without downloading the image and re-uploading it? This isn't really about dealing with the case where the person you're sharing with is sharing without your consent. The problem is really a case of data vs. metadata. If I get your browsing history it shouldn't give me access to all your private messages and private photos. As-described, getting access to metadata (urls) gives full access to data, which is not a good default behavior.
    - ehsankia 7y ago
      Facebook has an entirely different usage model. People have "profiles" and when you connect to someone's "profile", you see all their photos. Google Photos doesn't have an equivalent. Photos are in your account, and whenever you want, you share single ones, or group of them in an album, with friends. There's no concept of "friends" on Photos.
sp332 7y ago
I assumed that sharing photos the way he does in the video would limit access to that user, logged-in. I've been going to a lot more hassle by getting the URL, then manually creating an email with that link. So this interface is bad for people who want to make a sharable link and people who didn't want to make a sharable link. It should be clearer.
Lendal 7y ago
Agreed. This is exactly how I figured it would work, and how I would want it to work, and for these exact reasons. The only thing this story reveals to me is the apparent disconnect between how things actually work and how people think they ought to work-->magic.
- ehsankia 7y ago
  Honestly the majority of the "outrage articles" in the past few years have been based on that exact premise. Should companies gives people the experience and features they expect, or should they dumb down and simplify these services so that everyone knows exactly what's going on? Is the fact that average people don't know that there's a "My Activity" page Google's fault or on the user? I don't think there's an easy answer but tech sites sure love milking it for views.
zawerf 7y ago
I could be a lot happier if they gave me access to the analytics data (which they most definitely do log). It would let me freak out if there's an unexpected amount of traffic or any referrers from crawlers/reddit/social media. But otherwise, this seems like another story about how nontechnical people are being surprised by underlying details behind technology. In the sense of "omg we are being tracked" except in this instance it's just realizing that even if you have an unguessable url, someone can access it if you accidentally give it out... big whoop.
- josteink 7y ago
  > I could be a lot happier if they gave me access to the analytics data (which they most definitely do log) Back in the days us geeks would just fire up a web-server and call it a day. What happened?
  - cddotdotslash 7y ago
    Apparently everyone on HN wants the benefits of consumer products but with "geek" features included.
    - ajmurmann 7y ago
      "geek feature" == knowing that nobody on 4chan will be masturbating to your vacation photos.
    - rock_hard 7y ago
      Not surprised
  - jvolkman 7y ago
    We found better and/or more enjoyable things to do with our time.
    - neilv 7y ago
      That's presumably part of it, but dotcom wealth mostly comes from gaining centralized power over people. So most energy of the last 20 years has been focused on creating and entrenching middlepersons, rather than on developing decentralized approaches. And most of what decentralization you hear lately is mostly cryptocurrency-style scams, attempts to ride blockchain hype for an incredibly crappy database, and solutions focused on the priorities of people doing illegal things. Rather than very simple ideas from the original Web, like "everyone can have their own Web servers, and we build from there," for example.
didibus 7y ago
Could add a simple security question. So when you want to share, you could create a question and an answer like: What's my first name? John Most people you share with would know that. It could add a small extra security layer.
Sylamore 7y ago
FWIW when you create a public link for a photo or document or folder from OneDrive, you get an option to set an expiration date on the link. I pretty much set all of my public links to expire after 30 days this way.
nlawalker 7y ago
In my opinion, the main problem is that the interface doesn't make it abundantly clear that you're generating and sharing an unauthenticated link to the photo. Compare this with OneDrive/Office 365, where all the language around this functionality is explicitly about links ("Get a link", "share a link", as opposed to "share with this user"), and the UI prompts that appear are very explicit about what the link does ("Anyone with the link will be able to edit the file", "Anyone in this organization with the link will be able to view the file").
- C14L 7y ago
  Would be intersting to see a user study of the two services to measure the number of people who actually understand what the "sharing" is doing.
- tsbinz 7y ago
  I agree that office has a nice granularity there, but the UI is not very good. People don't understand that they have to share a specific link to a document and they can't just copy & paste the address of the page they are seeing ... Link shared -> "don't have permission" -> sender replies confused that the link works for him is an exchange I have seen way too many times.
- deleted 7y ago
  [deleted]
sammorrowdrums 7y ago
I mean they could just provide a link and a code and non-google accounts require the code... It should probably at least be an option. I guess once you've shared those photos it's only trust that protects them anyway and in a group where you don't have full trust, you should assume that the photos are essentially public with only security by obscurity. I mean the hash lengths and the blocking of people hitting random hashes is probably more significant and I imagine Google have considered it.
albedoa 7y ago
> What are the easier alternatives? Emailing maybe? But then you've moved the bits into someone else's account and they are there forever and can be forwarded anywhere. Maybe print a physical copy? Then that copy is around forever and can be handed to anyone else. The problem is that it acts differently from and less transparently than a similar Google service for no apparent reason. You disagree with the offered solution that the behavior of Photos should match that of Drive, but do you agree there's a problem?
gregmac 7y ago
We all know as soon as content is presented to a user it can be copied, and I think with photos in particular users know how to do this easily (via screenshot, if nothing else). I could see the argument could be made that doing anything that makes it appear like you can revoke access in the future would be somewhere between misleading and pointless. Not saying the Google Photos sharing UX can't be improved, but doing much more than improving wording is probably not worthwhile. I'm personally happy with URLs and text like "anyone with this url (including anyone they share it with) can view, download and copy the photo(s) you've selected".
spullara 7y ago
If someone can see the photo they have the bits. Making them an explicit copy via email isn't really different. Most messaging apps even support saving the photos shared in them.
giancarlostoro 7y ago
> What are the easier alternatives? Emailing maybe? But then you've moved the bits into someone else's account and they are there forever and can be forwarded anywhere. Maybe print a physical copy? Then that copy is around forever and can be handed to anyone else. The second these pictures are on anybodys devices they can be exported and forwarded... Are you implying Google Photos can stop them from doing this? Because it cant.
qrbLPHiKpiux 7y ago
> perfectly valid way to secure a resource. There are none. Once an endpoint has something, it's on their machine. Right click, Save As...
- signal11 7y ago
  Flickr has had a feature for a long time now that tries to defeat "Save as". Of course, browsers' Dev Tools are a trivial workaround. FWIW if you have a Flickr CDN URL then that too seems to work without any authentication. For instance: https://live.staticflickr.com/65535/48274947792_bf34cdc98a_o.jpg https://live.staticflickr.com/65535/48274947792_bf34cdc98a_o...
felipemnoa 7y ago
>>But then you've moved the bits into someone else's account and they are there forever and can be forwarded anywhere. Once you've shared a link to a photo you have shared the data with said person forever. They can simply download it into their computers, or take a screen shot, or take a picture of the picture. It is futile to worry about stuff like this if you are sharing it in the first place.
- thaumasiotes 7y ago
  This exact "vulnerability" is very commonly reported to public bug bounty programs. You've given one of the two major reasons it's almost always rejected. (The other being "sure, you can see the photo if you know the URL, but the URL is impossible to enumerate or guess". If you posit that the recipient discloses the URL to a malicious third party... you're back at scenario 1, where the recipient directly discloses the photo instead.) This finding doesn't appear to be listed on Google's master page of ineligible vulnerabilities ( https://sites.google.com/site/bughunteruniversity/nonvuln https://sites.google.com/site/bughunteruniversity/nonvuln ), but the most likely outcome of this Medium post is that... it gets listed, and nothing else is done.
dredmorbius 7y ago
This is a crucial distinction between physical and mediated worlds. If I show a snap in my wallet, or even displayed on my screen (mobile, desktop, projection), I'm providing a physical object or representation, and the recipient visualises it directly via reflected or emitted light. Cue childhood games over "can I see it" vs. 'can I hold it". This also plays on the brain's very poor performance at photographic (figuratively and metaphorically) recall. Digital devices not merely excel at this, they'd be unusable without it. Online "sharing" is actually a form of publishing, encoding, distribution, storage, retrieval, decoding, and projection, with, as a direct consequence, the possibility for further redistribution and modification. "Bradley Chait" and The Fappening, among far too many others. A webpage isn't a book, it's a printing press (and presses are not archival mechanisms, though archives may have presses). This distinction, between direct vs. mediated experience, lies at the heart of many misunderstandings and mishaps of online and digitised information, hitting the lay public, organisations and institutions, and domain experts alike. Our metaphors, mental models, laws, and social norms fail us But there is no technical way to provide remote access to bits -- a publishing and distribution transaction -- without relenquishing control over the contents. There are technical means of watermarking or tracing such leaks, and time-limited access helps somewhat, but absent changes to underlying social and legal norms, those alone are grossly insufficient.
homero 7y ago
This isn't the link. It's the share to account
ramblerman 7y ago
Ok, but the UI could easily offer both. 1) share with specific people 2) make public It's not hard to understand, and it would be more explicit about what it is doing. As it is it should provide a subtle notification imo, that the link generated is viewable by anyone.

by pkulak 7y ago

DominikPeters 7y ago

Why not do it exactly like Drive, where you can choose between sharing by link, or sharing with Google accounts?

pkulak 7y ago
Well, you can already share photos with other Google accounts. It's even the default. You have to specifically click the "Create Link" button on the share page to do differently.
- sp332 7y ago
  That is not what happens in the video.
- DominikPeters 7y ago
  In Photos, it looks like you can choose between the two, but actually sharing to a Google account also creates a link without making it explicit.
  - pkulak 7y ago
    Oh, I see what you mean. It looks like if the person you share to doesn't use Photos, they get a link sent by email. It takes a pretty deep understanding to avoid sending a link.
  - chaosite 7y ago
    It doesn't matter if the person you're sharing with is using Photos or not. Either way, a link is created, and you can access it without being logged in to a Google Account at all.
- chaosite 7y ago
  No, that's wrong, and that's the thing that's surprising here. If you share with a Google account a globally shareable link is created and is emailed to the person.
ehsankia 7y ago
And then you get dozens of email from every friend requesting access to the photo, which you have to manually approve? Might work nicely for a document, but that would be a really shitty UX for sharing photos with friend group and relatives.
- lukeschlather 7y ago
  Why not do it like Facebook and make it totally impossible to turn a private photo into a public link without downloading the image and re-uploading it? This isn't really about dealing with the case where the person you're sharing with is sharing without your consent. The problem is really a case of data vs. metadata. If I get your browsing history it shouldn't give me access to all your private messages and private photos. As-described, getting access to metadata (urls) gives full access to data, which is not a good default behavior.
  - ehsankia 7y ago
    Facebook has an entirely different usage model. People have "profiles" and when you connect to someone's "profile", you see all their photos. Google Photos doesn't have an equivalent. Photos are in your account, and whenever you want, you share single ones, or group of them in an album, with friends. There's no concept of "friends" on Photos.

sp332 7y ago

I assumed that sharing photos the way he does in the video would limit access to that user, logged-in. I've been going to a lot more hassle by getting the URL, then manually creating an email with that link. So this interface is bad for people who want to make a sharable link and people who didn't want to make a sharable link. It should be clearer.

Lendal 7y ago

Agreed. This is exactly how I figured it would work, and how I would want it to work, and for these exact reasons. The only thing this story reveals to me is the apparent disconnect between how things actually work and how people think they ought to work-->magic.

ehsankia 7y ago
Honestly the majority of the "outrage articles" in the past few years have been based on that exact premise. Should companies gives people the experience and features they expect, or should they dumb down and simplify these services so that everyone knows exactly what's going on? Is the fact that average people don't know that there's a "My Activity" page Google's fault or on the user? I don't think there's an easy answer but tech sites sure love milking it for views.

zawerf 7y ago

I could be a lot happier if they gave me access to the analytics data (which they most definitely do log). It would let me freak out if there's an unexpected amount of traffic or any referrers from crawlers/reddit/social media. But otherwise, this seems like another story about how nontechnical people are being surprised by underlying details behind technology. In the sense of "omg we are being tracked" except in this instance it's just realizing that even if you have an unguessable url, someone can access it if you accidentally give it out... big whoop.

josteink 7y ago
> I could be a lot happier if they gave me access to the analytics data (which they most definitely do log) Back in the days us geeks would just fire up a web-server and call it a day. What happened?
- cddotdotslash 7y ago
  Apparently everyone on HN wants the benefits of consumer products but with "geek" features included.
  - ajmurmann 7y ago
    "geek feature" == knowing that nobody on 4chan will be masturbating to your vacation photos.
  - rock_hard 7y ago
    Not surprised
- jvolkman 7y ago
  We found better and/or more enjoyable things to do with our time.
  - neilv 7y ago
    That's presumably part of it, but dotcom wealth mostly comes from gaining centralized power over people. So most energy of the last 20 years has been focused on creating and entrenching middlepersons, rather than on developing decentralized approaches. And most of what decentralization you hear lately is mostly cryptocurrency-style scams, attempts to ride blockchain hype for an incredibly crappy database, and solutions focused on the priorities of people doing illegal things. Rather than very simple ideas from the original Web, like "everyone can have their own Web servers, and we build from there," for example.

didibus 7y ago

Could add a simple security question. So when you want to share, you could create a question and an answer like: What's my first name? John Most people you share with would know that. It could add a small extra security layer.

Sylamore 7y ago

FWIW when you create a public link for a photo or document or folder from OneDrive, you get an option to set an expiration date on the link. I pretty much set all of my public links to expire after 30 days this way.

nlawalker 7y ago

In my opinion, the main problem is that the interface doesn't make it abundantly clear that you're generating and sharing an unauthenticated link to the photo. Compare this with OneDrive/Office 365, where all the language around this functionality is explicitly about links ("Get a link", "share a link", as opposed to "share with this user"), and the UI prompts that appear are very explicit about what the link does ("Anyone with the link will be able to edit the file", "Anyone in this organization with the link will be able to view the file").

C14L 7y ago
Would be intersting to see a user study of the two services to measure the number of people who actually understand what the "sharing" is doing.
tsbinz 7y ago
I agree that office has a nice granularity there, but the UI is not very good. People don't understand that they have to share a specific link to a document and they can't just copy & paste the address of the page they are seeing ... Link shared -> "don't have permission" -> sender replies confused that the link works for him is an exchange I have seen way too many times.
deleted 7y ago
[deleted]

sammorrowdrums 7y ago

I mean they could just provide a link and a code and non-google accounts require the code... It should probably at least be an option. I guess once you've shared those photos it's only trust that protects them anyway and in a group where you don't have full trust, you should assume that the photos are essentially public with only security by obscurity. I mean the hash lengths and the blocking of people hitting random hashes is probably more significant and I imagine Google have considered it.

albedoa 7y ago

> What are the easier alternatives? Emailing maybe? But then you've moved the bits into someone else's account and they are there forever and can be forwarded anywhere. Maybe print a physical copy? Then that copy is around forever and can be handed to anyone else. The problem is that it acts differently from and less transparently than a similar Google service for no apparent reason. You disagree with the offered solution that the behavior of Photos should match that of Drive, but do you agree there's a problem?

gregmac 7y ago

We all know as soon as content is presented to a user it can be copied, and I think with photos in particular users know how to do this easily (via screenshot, if nothing else). I could see the argument could be made that doing anything that makes it appear like you can revoke access in the future would be somewhere between misleading and pointless. Not saying the Google Photos sharing UX can't be improved, but doing much more than improving wording is probably not worthwhile. I'm personally happy with URLs and text like "anyone with this url (including anyone they share it with) can view, download and copy the photo(s) you've selected".

spullara 7y ago

If someone can see the photo they have the bits. Making them an explicit copy via email isn't really different. Most messaging apps even support saving the photos shared in them.

giancarlostoro 7y ago

> What are the easier alternatives? Emailing maybe? But then you've moved the bits into someone else's account and they are there forever and can be forwarded anywhere. Maybe print a physical copy? Then that copy is around forever and can be handed to anyone else. The second these pictures are on anybodys devices they can be exported and forwarded... Are you implying Google Photos can stop them from doing this? Because it cant.

qrbLPHiKpiux 7y ago

> perfectly valid way to secure a resource. There are none. Once an endpoint has something, it's on their machine. Right click, Save As...

signal11 7y ago
Flickr has had a feature for a long time now that tries to defeat "Save as". Of course, browsers' Dev Tools are a trivial workaround. FWIW if you have a Flickr CDN URL then that too seems to work without any authentication. For instance: https://live.staticflickr.com/65535/48274947792_bf34cdc98a_o.jpg https://live.staticflickr.com/65535/48274947792_bf34cdc98a_o...

felipemnoa 7y ago

>>But then you've moved the bits into someone else's account and they are there forever and can be forwarded anywhere. Once you've shared a link to a photo you have shared the data with said person forever. They can simply download it into their computers, or take a screen shot, or take a picture of the picture. It is futile to worry about stuff like this if you are sharing it in the first place.

thaumasiotes 7y ago
This exact "vulnerability" is very commonly reported to public bug bounty programs. You've given one of the two major reasons it's almost always rejected. (The other being "sure, you can see the photo if you know the URL, but the URL is impossible to enumerate or guess". If you posit that the recipient discloses the URL to a malicious third party... you're back at scenario 1, where the recipient directly discloses the photo instead.) This finding doesn't appear to be listed on Google's master page of ineligible vulnerabilities ( https://sites.google.com/site/bughunteruniversity/nonvuln https://sites.google.com/site/bughunteruniversity/nonvuln ), but the most likely outcome of this Medium post is that... it gets listed, and nothing else is done.

dredmorbius 7y ago

This is a crucial distinction between physical and mediated worlds. If I show a snap in my wallet, or even displayed on my screen (mobile, desktop, projection), I'm providing a physical object or representation, and the recipient visualises it directly via reflected or emitted light. Cue childhood games over "can I see it" vs. 'can I hold it". This also plays on the brain's very poor performance at photographic (figuratively and metaphorically) recall. Digital devices not merely excel at this, they'd be unusable without it. Online "sharing" is actually a form of publishing, encoding, distribution, storage, retrieval, decoding, and projection, with, as a direct consequence, the possibility for further redistribution and modification. "Bradley Chait" and The Fappening, among far too many others. A webpage isn't a book, it's a printing press (and presses are not archival mechanisms, though archives may have presses). This distinction, between direct vs. mediated experience, lies at the heart of many misunderstandings and mishaps of online and digitised information, hitting the lay public, organisations and institutions, and domain experts alike. Our metaphors, mental models, laws, and social norms fail us But there is no technical way to provide remote access to bits -- a publishing and distribution transaction -- without relenquishing control over the contents. There are technical means of watermarking or tracing such leaks, and time-limited access helps somewhat, but absent changes to underlying social and legal norms, those alone are grossly insufficient.

homero 7y ago

This isn't the link. It's the share to account

ramblerman 7y ago

Ok, but the UI could easily offer both. 1) share with specific people 2) make public It's not hard to understand, and it would be more explicit about what it is doing. As it is it should provide a subtle notification imo, that the link generated is viewable by anyone.