Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

reddit.com

Post reply on HN
Print view View original

11–20 of 60 posts

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#11

Post by daleharvey »

cryptnoob wrote: post #8
swombat wrote: post #5

Lesson: If you launch something like QuipTxt, make it obvious to people that their images are public, so that the idiots who harbour the impression that stuff uploaded on a public URL on a free website don't come running at you with pitchforks. Additional benefit: more network effects. I don't really see the difference between this service and Twitpic (hard to tell since the site is down, though).

If you launch something like QuipTxt, make it obvious to people that their images are public Google Picasa stores images as public URLs without any such warning. Because with random URL's, you effectively have passworded each image. Even more secure than if they were all locked into a nice MySQL database, because then they would all be behind only a single password. I think you don't have to freak out users with too…

if you only need to guess something address to see it, it is public

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#12

Post by prog »

frognibble wrote: post #3

The founder of the company responded on the Reddit thread: http://www.reddit.com/r/pics/comments/bjezp/massive_privacy_... The application is described in the iTunes store: http://itunes.apple.com/app/quip-free-photo-texting/id291358...

Interestingly this flaw was reported in 2009 on Digg. http://digg.com/security/Quip_TXT_for_iPhone_FAIL_WIN_NSFW I am not sure if QuitTxt tried fixing it that time.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#13

Post by arethuza »

cryptnoob wrote: post #8
swombat wrote: post #5

Lesson: If you launch something like QuipTxt, make it obvious to people that their images are public, so that the idiots who harbour the impression that stuff uploaded on a public URL on a free website don't come running at you with pitchforks. Additional benefit: more network effects. I don't really see the difference between this service and Twitpic (hard to tell since the site is down, though).

If you launch something like QuipTxt, make it obvious to people that their images are public Google Picasa stores images as public URLs without any such warning. Because with random URL's, you effectively have passworded each image. Even more secure than if they were all locked into a nice MySQL database, because then they would all be behind only a single password. I think you don't have to freak out users with too…

Yes, but passwords are typically used as a form of authentication (i.e. something you know) - to prove the identity of the user.

Once a user has authenticated themselves then it is a separate problem to decide what they are authorized to see.

Even really complex keys in links are still a big problem as they are far too easy to pass around - I've seen multiple problems on commercial systems and products where documents didn't require authentication before access and "security" relied on having an obscure key value directly represented in a link.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#14

Post by gizmo »

DanielBMarkham wrote: post #6

Two things in this story that are not new, but still amazing to me. 1) A significant portion of people love taking pictures of themselves naked. This portion seems to be growing. 2) Another significant potion of people love publishing and making fun of people for whatever reason they can find. These people will dig through your trash, hack your servers, socially-engineer your passwords, etc. The more they can publicl…

1) ... of which a significant portion is underage. I wouldn't be comfortable hosting such a service.

2) It's not clear to me this portion of the population is growing, but it does bother me that those people don't get the disdain they deserve (according to me).

That said, I think the company in question should be held liable for these kind of breaches. It's your responsibility as an online service to protect the privacy of your users. Even if the service is free you're still obligated to properly secure the service, and if you don't have the expertise to secure it yourself hire somebody to do it for you or don't run the service!

I don't expect most of you here to agree with me, in fact, I expect most of you to vehemently disagree. And web services? Reddit: didn't hash passwords, database got stolen. HN? Still doesn't hash passwords, as far as I know. 37signals? Same. The list goes on.

Yes, it sucks that people take advantage of lousy security, but in the end I think it's the web service that's been grossly negligent, and I think that we shouldn't accept this kind of malpractice.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#15

Post by mseebach »

Willie_Dynamite wrote: post #7

Ahh, the cloud. Such a great idea.

Less than six months ago, some internal (non-confidential, non-critical, but, none the less, internal) documents of a client of mine showed up on Google. The reason? They were public files in a folder on the webserver, and someone turned on Indexes in Apache. It is the exact same problem.

Not even the shadow of a cloud (pun intended) was involved.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#16

Post by gizmo »

jcromartie wrote: post #9
DanielBMarkham wrote: post #6

Two things in this story that are not new, but still amazing to me. 1) A significant portion of people love taking pictures of themselves naked. This portion seems to be growing. 2) Another significant potion of people love publishing and making fun of people for whatever reason they can find. These people will dig through your trash, hack your servers, socially-engineer your passwords, etc. The more they can publicl…

People don't change. Everybody is a pervert or a sadist or something. Everybody does something weird when they think nobody is looking. The population is growing, and so there is certainly more going on at any one time, but I doubt the portion is really growing.

The issue isn't that people enjoy weird things, it's that people do things that hurt others, and don't feel guilty about it.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#17

Post by cryptnoob »

daleharvey wrote: post #11
cryptnoob wrote: post #8

Earlier quoted context omitted.

If you launch something like QuipTxt, make it obvious to people that their images are public Google Picasa stores images as public URLs without any such warning. Because with random URL's, you effectively have passworded each image. Even more secure than if they were all locked into a nice MySQL database, because then they would all be behind only a single password. I think you don't have to freak out users with too…

if you only need to guess something address to see it, it is public

I disagree.

A password is not a magic spell. It's a set of letters and numbers that, if guessed correctly, will give me access to something you wanted kept private.

An obfuscated URL is a set of letters and numbers that, if guessed correctly, will give me access to something you wanted kept private.

Because one uses a MySQL database, and the other uses a file system, is irrelevant. They are functionally identical when directory listing is disabled, as it can be for Amazon S3.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#18

Post by gizmo »

daleharvey wrote: post #11
cryptnoob wrote: post #8

Earlier quoted context omitted.

If you launch something like QuipTxt, make it obvious to people that their images are public Google Picasa stores images as public URLs without any such warning. Because with random URL's, you effectively have passworded each image. Even more secure than if they were all locked into a nice MySQL database, because then they would all be behind only a single password. I think you don't have to freak out users with too…

if you only need to guess something address to see it, it is public

The average Google Docs link has more entropy than the average username/password combination. So unless you want to argue that everything online is public to some extent, I don't think your claim makes much sense.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#19

Post by gizmo »

swombat wrote: post #5

Lesson: If you launch something like QuipTxt, make it obvious to people that their images are public, so that the idiots who harbour the impression that stuff uploaded on a public URL on a free website don't come running at you with pitchforks. Additional benefit: more network effects. I don't really see the difference between this service and Twitpic (hard to tell since the site is down, though).

The users aren't the idiots here, they had no reason to assume their private pictures would be shared (and even if you put a disclaimer on there, you can't expect people to read that). Besides, the admins of the service must have been fully aware people were sharing sensitive pictures, and they did nothing about it! And it wasn't a public URL, it was a URL secured by a lousy hash. Virtually indistinguishable from a URL generated by Google Docs.

I think your statement (where you call the users idiots) represents everything that's wrong with the current security-lax web services crowd.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#20

Post by cryptnoob »

mseebach wrote: post #15
Willie_Dynamite wrote: post #7

Ahh, the cloud. Such a great idea.

Less than six months ago, some internal (non-confidential, non-critical, but, none the less, internal) documents of a client of mine showed up on Google. The reason? They were public files in a folder on the webserver, and someone turned on Indexes in Apache. It is the exact same problem. Not even the shadow of a cloud (pun intended) was involved.

I just had google index my ajax directory. I have a directory where I keep ajax files. The only link to them is through my javascript ajax calls.

I was pretty surprised that Google goes through your javascript, harvesting your ajax links.

Post reply on HN