4 ms·

It’s also really hard to audit, so if Google shares it and people access it, Google won’t know. This is not cool for me because I don’t want my photos availabl

It’s also really hard to audit, so if Google shares it and people access it, Google won’t know. This is not cool for me because I don’t want my photos available to people other than me, even if they have my magic url with a token I didn’t create and can’t revoke.

kyle-rb 5y ago
How is a magic url really any different from a magic login cookie in this case? Yeah, I guess you can't revoke it, but what's the difference if the new cookie/url is equally unguessable?
- prepend 5y ago
  I create and revoke tokens, that’s a big difference. With magic urls, I don’t know they exist so I can’t share or control them.
morgosmaci 5y ago
You can revoke a link. Go to the shared album page. (clicking on the link will take you there) Click the options menu item and there is a toggle for link sharing that will revoke the magic url and token.
- jeffbee 5y ago
  You can revoke sharing links, but there are also direct links to photos that work for unauthenticated clients. They aren't presented in the UI as a sharing option; you have to use your browser to copy the link. In other words the only way to make these links public is through intentional user action.
  - morgosmaci 5y ago
    This shouldn't be true any more, I just tried it out by grabbing the lh[0-9]* url for the image bytes and that won't open in an incognito browser without a Google Login. Can you share with me how to reproduce this "url copy"? If you want to send it privately just tack gmail.com onto my username. Or you can file feedback from the photo web page and just tag me in it.
    - jeffbee 5y ago
      I just tried it with an lh3 url I got from chrome, opens fine in incognito. Repro easily: from /photo/ page, open image in new tab; copy address to incognito; expected: login challenge, actual: photo.
      - morgosmaci 5y ago
        Ah so it does, but that URL has a bearer token that only lasts for one minute. Try it again after a minute. Edit: I don't work on this stuff, but have seen it challenge me when trying to do this exact thing.

kyle-rb 5y ago

How is a magic url really any different from a magic login cookie in this case? Yeah, I guess you can't revoke it, but what's the difference if the new cookie/url is equally unguessable?

prepend 5y ago
I create and revoke tokens, that’s a big difference. With magic urls, I don’t know they exist so I can’t share or control them.

morgosmaci 5y ago

You can revoke a link. Go to the shared album page. (clicking on the link will take you there) Click the options menu item and there is a toggle for link sharing that will revoke the magic url and token.

jeffbee 5y ago
You can revoke sharing links, but there are also direct links to photos that work for unauthenticated clients. They aren't presented in the UI as a sharing option; you have to use your browser to copy the link. In other words the only way to make these links public is through intentional user action.
- morgosmaci 5y ago
  This shouldn't be true any more, I just tried it out by grabbing the lh[0-9]* url for the image bytes and that won't open in an incognito browser without a Google Login. Can you share with me how to reproduce this "url copy"? If you want to send it privately just tack gmail.com onto my username. Or you can file feedback from the photo web page and just tag me in it.
  - jeffbee 5y ago
    I just tried it with an lh3 url I got from chrome, opens fine in incognito. Repro easily: from /photo/ page, open image in new tab; copy address to incognito; expected: login challenge, actual: photo.
    - morgosmaci 5y ago
      Ah so it does, but that URL has a bearer token that only lasts for one minute. Try it again after a minute. Edit: I don't work on this stuff, but have seen it challenge me when trying to do this exact thing.