Tell HN: Every photo in Facebook is somewhat publicly accessible

https://news.ycombinator.com/item?id=1739243

by skbohra123 • 16 years ago

43 88 16 years ago

news.ycombinator.com

Facebook generates a static url for each photo you upload. Regardless of what your privacy settings are, anyone can access that photo if he knows url of that photo. I don't think that this should be the ideal behaviour? I tried changing my privacy settings such that photos I am tagged in, should be visible to 'only me', but regardless of this, anyone who knows this url can see this photo. I think this is a big privacy leak issue, or am I missing some point ?

dangrover• 16 years ago

I think it's pretty safe as long as no one without the permissions can find (or guess/extrapolate) that URL. The images are probably just hosted by a CDN and serving up the files with authentication might slow it down or complicate the setup.

skbohra1238• 16 years ago

So, this is the ideal way to host static files? I think this is something like a pseudo security, isn't it? What we call is 'ostrich' approach to security. There must be some better way to do this.

tptacek16• 16 years ago

Requiring attackers to guess a 128 bit random number (actually, fbcdn seems to use 136 bit random numbers) isn't "psuedo" security.

Aegean• 16 years ago

I am surprised this is standard behavior. So if I allow user X to see my photos it means that user has a right to publish all my photo urls. It doesn't look good to me.

jules• 16 years ago

Are passwords pseudo security too? They are easier to guess than a random url. That one is entered in a form field and the other in the url bar doesn't really matter does it?

DVassallo• 16 years ago

The same thing happens in Picasa Web Albums. Photos in private albums are still accessible if the URL to the jpg image is known. The situation in Picasa is quite particular, since you get to choose between three visibility options when an album is created:

- Public

- Anyone with the link

- Private

The "Anyone with the link" option means that Picasa generates a "difficult to guess" URL for the whole album. That's fine and well documented, but the "Private" option might imply that anyone with the link won't be able to access individual photos, which is not the case. I'm afraid users might feel that their photos are hidden as much as emails are in GMail, for example.

Terretta5• 16 years ago

Flickr changes a photo's URLs any time you adjust the privacy settings.

Downside: toggling privacy breaks links to the photo.

Upside: toggling privacy breaks links to the photo.

tptacek16• 16 years ago

No, they aren't.

Every photo in Facebook is accessible if you know the its secret photo ID, which is an unguessably large random number.

It's not completely optimal that Facebook embeds secrets in URLs this way (for example, if you browse directly to a photo via its fbcdn URL, you'll have planted the secret in your browser history). But it's a common industry practice, and since it's used on URLs that shouldn't normally end up in your browser history, it's hard to see the major problem with it.

So yes, you're missing a major point, and you haven't found a big privacy leak. Sorry.

skbohra1238• 16 years ago

A secret Id that every user you have shared the photo with knows and hence can publish them ? Uh.

tptacek16• 16 years ago

The photograph itself is just a larger and less random number that can also be published.

laskito• 16 years ago

Your "friend" can download the photo and publish it somewhere else, open for everyone.

mquander• 16 years ago

Can someone explain to me what on Earth is going on in this comment thread? This response doesn't make any sense. Obviously, if you share your photo with someone, they can publish your photo! Welcome to the world of digital media! Why is this modded up, and the grandparent modded down? (Edit: It's more sane now, when I posted this the above was at 7 and tptacek was at -1.)

skbohra1238• 16 years ago

I understand this isn't a big privacy leak. It looked awkward to me at first instance. I am trying to find what the general industry practice is in this and what could be the ideal solution as we are trying to build some image hosting for our product. Your answer is very insightful indeed.

tptacek16• 16 years ago

Now that you know the answer, maybe you should edit your HN post so that it isn't broadcasting "Facebook is insecure" on the HN RSS feed.

Terretta5• 16 years ago

I typically appreciate tptacek's security remarks, and agree that once you trust someone to view a photo, you're trusting them to not repost it.

However, I disagree that "everyone is doing it this way" is a good reason to do it this way.

Flickr, as I noted separately in this thread, doesn't do it this way. Changing privacy settings changes the URL, so someone using the URL (a common use case for images) can't use it any more. That's the "user expected" behavior. Facebook's behavior is a generally unwelcome surprise.

Additionally, since you're considering building image hosting: "token protected" URLs are well understood and often applied as a best effort solution to this problem. A token protected URL typically has an expiry, and in typical use is only valid briefly when issued for the visitor requesting the (authenticated) page containing embedded photos.

See: http://aws.typepad.com/aws/2009/11/new-amazon-cloudfront-fea...

Of course, the CDN edge cache servers have to cache the object yet respect the tokens, which requires a bit more intelligence from the cache, which is why "general industry practice" is to take the easier shortcut of not protecting the URL and image object at all.

Disclaimer: We offer token protected video and image CDN delivery, calling it "deep link protection". Our DLP, and token schemes in general, protect the link from misuse, not the asset.

jhuckestein2• 16 years ago

Sounds like security by obscurity to me, which in my book is bad.

On their way through the web (unencrypted, mind you), the urls are visible to anyone. Any proxy server can start farming image urls. And what happens if someone reverse-engineers the number generation algorithm?

This is industry practice because it's cheap and the risk for exploitation is low. That doesn't mean it's secure or good. The OP is not missing a point.

tptacek16• 16 years ago

If you can "reverse-engineer" (you mean "break") any common cryptographically secure random generator --- such as is provided by every mainstream operating system on the planet --- you can do far worse things than see Facebook photos. CSPRNGs are the font from which all real crypto keys spring. Viable attacks on RNGs are devastating to real cryptosystems. So relying on a CSPRNG isn't going out on a limb.

As for the rest of it: if you can capture the ID, you can capture the photo. See other comments on this thread for why that is and why it matters.

amalcon2• 16 years ago

It's not really "security by obscurity", because the security mechanism is known to all. There's an authentication token that controls access to the image.

There are only two unusual factors. The token is contained in the URL instead of a cookie (which actually reduces the obscurity, but has no other effect). Also, the token is per-resource as opposed to per-user (which has both advantages and disadvantages).

brlewis2• 16 years ago

On their way through the web the images themselves are visible to "anyone" (any nodes or shared ethernets the packets go through), so if your photos are incriminating you should find a host you're willing to trust that will serve them https-only, or host them yourself.

Those of us having grown up bringing film to the drugstore aren't too concerned about URLs in our ISP's proxy server logs. Nobody cares about your facebook photos enough to risk their job at the ISP to steal them.

adharmad2• 16 years ago

Facebook allows very sophisticated privacy settings, including allowing access to photos for a specific subset of users only.

I wonder what those privacy settings mean then, if the authorization checks are not happenning when the photo is accessed?

tptacek16• 16 years ago

Presumably it means that anyone you show a photo to intentionally can in turn show it to people you don't intend to see the photo. Which, of course, must be true, no matter what Facebook does to protect photos.

dawsdesign• 16 years ago

The authorization happens at the time you request the photo url, not the photo itself. So the security is on finding out what the url is, not the actual photo request. It'd be the same as someone being able to login if they know your password. That URL is the password.

skbohra1238• 16 years ago

A quick google image search to the domain http://sphotos.ak.fbcdn.net/photos-ak-snc1/v2010 gives me a large number of images hosted there http://bit.ly/9Lp3r5 . This isn't the behaviour I would like.

_b8r0• 16 years ago

Nice find. This is why it's 'not optimal' as Thomas puts it. Does anyone want to test what happens at different privacy settings? Sorry, I don't really use facebook.

tptacek16• 16 years ago

This is presumably happening because people are deliberately taking images people gave them access to and embedding them on web pages Google is indexing.

The difference between this and "People of Facebook", the site where you can upload images your friends show you on Facebook, is that Facebook can detect, track, and disable these images, but can't do anything technical about images uploaded to "People of Facebook".

It is just silly to suggest that Facebook should take steps to prevent your friends from copying images. Nothing they do will work, and anything they do will create a false expectation of privacy on behalf of their users.

brlewis2• 16 years ago

Click on any of those images and the sidebar will tell you what web site Google found it on. This isn't a Facebook security hole. It's people publishing photos on the public web.

qeorge• 16 years ago

FWIW, the random number wasn't always large enough to be unguessable:

http://news.ycombinator.com/item?id=490788

tptacek16• 16 years ago

Which, ironically, makes me more confident in this implementation, because someone deliberately made them harder to guess; a lot of times, things look random and long but really aren't.

irahul• 16 years ago

But couldn't a better checkpoint be designed with some overhead?

Say all urls containing /static/.. don't refer to an actual physical resource but go to a controller which checks the access and then serves the file. As such, the URL if given to someone else will fail as the controller won't authorize the file transfer.

I did it once with nginx at the front and django at the backend using X-Sendfile. I don't have the code around but it was similar to what is proposed in this discussion: http://groups.google.com/group/django-users/browse_thread/th...

Of course, this can't be done for the CDNs.

When you say it's a common industry practice, is the practice there because of CDNs?

sgibat• 16 years ago

Many people are aware of this. It's been convenient so many times when needing to show a picture of some cute girl to my friends!

naner• 16 years ago

This is for convince so people can easily share private photos. It is a usability trade-off.

statictype3• 16 years ago

hm, not quite.

It's done this way because running code to authenticate+authorize the user before serving up an image incurs a much higher performance hit than just shoveling the bits directly off a disk. Especially when those bits can come from a content delivery network.

Facebook handles a ridiculously large number of photos - probably an order of magnitude more than any other site - so this trade off, I would guess, is pretty crucial to keeping the site up.

jhuckestein2• 16 years ago

I have a house in the woods and never lock the door because nobody knows where it is anyway! What's the problem?

This is definitely not an ideal setup, but it's hard to improve. The only solution I can think of is having an application server serve the pictures after authenticating the request. The picture servers would need to be connected to some sort of database to do that. Serving a single image would incur multiple times the current cost.

bbatsell• 16 years ago

> The only solution I can think of is having an application server serve the pictures after authenticating the request.

Or, make the URL fbcdn.com/p/timestamp/hash of internal salt + timestamp/unique ID.jpg. If the timestamp isn't from within the past 2 minutes, don't serve the image. Almost every static server offers this as a plugin, and it doesn't need to touch a database. AWS offers something similar as a time-limited "access key".

chopsueyar5• 16 years ago

Nice idea.

kree102• 16 years ago

But people can see your house in the woods. I think it's more like: see that forest out there? In one of those trees, I drilled a hole in the trunk and stuck a rolled-up $100 bill in it. Even though I told you it's out there, good luck finding it, unless I tell you which tree.

joezydeco• 16 years ago

Unless I rent a bloodhound for an afternoon for $50...

venturebros• 16 years ago

If you want to see photos of someone with a private account just find the name of someone on their list that has an open facebook account. Look through their wall (or whatever) and if you see them commenting on the persons photo just click that. You will not only see the photo but all the photos the album is housed in.

Much faster than trying to figure out URLs.

ErrantX2• 16 years ago

YMMV over this; sometimes it works sometimes it doesn't.

If the album owner is really locked down you can only see the photo commented on (I think it depends on whether you allow sharing with "friends of friends" or just "friends").

AndrewMoffat• 16 years ago

Equivalent headline:

"Tell HN: Every encrypted message is somewhat publicly accessible*

*if you guess the key/password"

statictype3• 16 years ago

Every photo is publicly accessible.

It's just not easily discoverable.

I agree, though, that this is mostly a non issue.

cjg• 16 years ago

The difference is that keys and passwords are managed in a more careful way (think encrypted key stores), whereas URLs are not handled with the same care.

Apart from that, I agree with you.

djhworld• 16 years ago

I've had a a few instances of a mate sending me a link to photos of people of whom I'm not friends with. So I agree that this is of a concern

statictype3• 16 years ago

They could just copy the photo and email that you. No amount of privacy code on FB's servers are going to be able to prevent that.

chopsueyar5• 16 years ago

Well, then they should only display it through a Flash app.

ErrantX2• 16 years ago

Random thought; you could make use of this as "free" image CDN (probably against the TOS but useful nonethless :))

chopsueyar5• 16 years ago

Another nice idea.

pclark• 16 years ago

I imagine Facebook photos get so much traffic they wouldn't even notice.

bhiller• 16 years ago

I have found another security hole: When viewing a photo, you can take a screenshot of it and upload it to anywhere else on the internet, where any arbitrary person can see it.

This violates all of my expectations of privacy.

juanito• 16 years ago

Another fun fact:

Even if you delete a photo from an album, Facebook doesn't get rid of it immediately. I know this because I was able to retrieve a photo that I'd seen in someone's album, a day after it had been removed from that album, by retrieving the image url in my browser history.

rryyan• 16 years ago

A related issue here is what happens when a user deletes a photo -- there is a lag time between the delete action and the CDN being updated. Deleted photos are still available via the direct image URL while the CDN is out of sync. As of July 2009 [1], the lag time was at least 2 months. So if the URL has been shared, access to the image may not be easily revoked.

[1] http://arstechnica.com/web/news/2009/07/are-those-photos-rea...

known• 16 years ago

I think photos are accessible in http://youropenbook.org/

wiks• 16 years ago

When i noticed it, I was freaked out for a while. I thought that is the same with the case of facebook videos but turned out it said,"This video either had been removed from Facebook or is not visible due to privacy settings." I Guess they should do the same with the photos too.

alastair• 16 years ago

Also worth mentioning that the image name / url isn't enterly random - it contains the profile ID of the owner. This means the reverse situation to the one mentioned in the OP is possible, where a linked photo can be traced back to the person's profile.

This is pretty well known but I havn't seen it mentioned in this thread yet.

nl• 16 years ago

It's actually worse than that. If you know the URL of the photo you can regenerate the url of the page it is on (and possibly see the gallery it is in) and the url of the profile it came from.

Tell HN: Every photo in Facebook is somewhat publicly accessible

Related Stories