50 ms·
>>But then you've moved the bits into someone else's account and they are there forever and can be forwarded anywhere. Once you've shared a link to a photo you
by felipemnoa 7y ago
>>But then you've moved the bits into someone else's account and they are there forever and can be forwarded anywhere.
Once you've shared a link to a photo you have shared the data with said person forever. They can simply download it into their computers, or take a screen shot, or take a picture of the picture. It is futile to worry about stuff like this if you are sharing it in the first place.
- thaumasiotes 7y agoThis exact "vulnerability" is very commonly reported to public bug bounty programs. You've given one of the two major reasons it's almost always rejected. (The other being "sure, you can see the photo if you know the URL, but the URL is impossible to enumerate or guess". If you posit that the recipient discloses the URL to a malicious third party... you're back at scenario 1, where the recipient directly discloses the photo instead.) This finding doesn't appear to be listed on Google's master page of ineligible vulnerabilities ( https://sites.google.com/site/bughunteruniversity/nonvuln https://sites.google.com/site/bughunteruniversity/nonvuln ), but the most likely outcome of this Medium post is that... it gets listed, and nothing else is done.