Live data from Hacker News

Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

reddit.com

21–30 of 60 posts

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#21

Earlier quoted context omitted.

If you launch something like QuipTxt, make it obvious to people that their images are public Google Picasa stores images as public URLs without any such warning. Because with random URL's, you effectively have passworded each image. Even more secure than if they were all locked into a nice MySQL database, because then they would all be behind only a single password. I think you don't have to freak out users with too…

Yes, but passwords are typically used as a form of authentication (i.e. something you know) - to prove the identity of the user. Once a user has authenticated themselves then it is a separate problem to decide what they are authorized to see. Even really complex keys in links are still a big problem as they are far too easy to pass around - I've seen multiple problems on commercial systems and products where document…

Sure. When you leave passwords floating around in plain text, bad things will happen too. It's too easy to forget that an obfuscated URL needs to be treated as a password.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#22
post #12

The founder of the company responded on the Reddit thread: http://www.reddit.com/r/pics/comments/bjezp/massive_privacy_... The application is described in the iTunes store: http://itunes.apple.com/app/quip-free-photo-texting/id291358...

Interestingly this flaw was reported in 2009 on Digg. http://digg.com/security/Quip_TXT_for_iPhone_FAIL_WIN_NSFW I am not sure if QuitTxt tried fixing it that time.

From the comment thread on Reddit it seems like the only thing they did, was to ban the ip address. Clever :)

http://www.reddit.com/r/pics/comments/bjezp/massive_privacy_...

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#23

Earlier quoted context omitted.

if you only need to guess something address to see it, it is public

I disagree. A password is not a magic spell. It's a set of letters and numbers that, if guessed correctly, will give me access to something you wanted kept private. An obfuscated URL is a set of letters and numbers that, if guessed correctly, will give me access to something you wanted kept private. Because one uses a MySQL database, and the other uses a file system, is irrelevant. They are functionally identical whe…

Locks on houses aren't infallible either, but establish intent: "you should not be here". Very short hashes don't do that quite so much.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#24

Two things in this story that are not new, but still amazing to me. 1) A significant portion of people love taking pictures of themselves naked. This portion seems to be growing. 2) Another significant potion of people love publishing and making fun of people for whatever reason they can find. These people will dig through your trash, hack your servers, socially-engineer your passwords, etc. The more they can publicl…

People don't change. Everybody is a pervert or a sadist or something. Everybody does something weird when they think nobody is looking. The population is growing, and so there is certainly more going on at any one time, but I doubt the portion is really growing.

To be fair, sending naked photos of yourself over the phone to your partner is hardly "pervert or sadist or something", maybe a bit kinky but that's it.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#25
post #2

Seems they had no security at all (just a random 5 character hash).. Reddit users are seemingly busy sharing nsfw pictures and linking them to facebook accounts, will probably result in a couple of suicides when all is said and done :(

Do not confuse Reddit and 4chan.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#26
A thought experiment for the large minds here: how long a string _would_ be sufficient? I wonder if any string is long enough if you don't also implement some sort of access control lockdown to prevent people poking your system endlessly, but what do you think?

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#27
post #16

Earlier quoted context omitted.

People don't change. Everybody is a pervert or a sadist or something. Everybody does something weird when they think nobody is looking. The population is growing, and so there is certainly more going on at any one time, but I doubt the portion is really growing.

The issue isn't that people enjoy weird things, it's that people do things that hurt others, and don't feel guilty about it.

[deleted]

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#28
post #16

Earlier quoted context omitted.

People don't change. Everybody is a pervert or a sadist or something. Everybody does something weird when they think nobody is looking. The population is growing, and so there is certainly more going on at any one time, but I doubt the portion is really growing.

The issue isn't that people enjoy weird things, it's that people do things that hurt others, and don't feel guilty about it.

I think it's more like "people like treating other people outside their reach as objects without regards to consequences and when there are bad consequences they feel a bit guilty about it but it's too late anyway."

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#29
post #25
post #2

Seems they had no security at all (just a random 5 character hash).. Reddit users are seemingly busy sharing nsfw pictures and linking them to facebook accounts, will probably result in a couple of suicides when all is said and done :(

Do not confuse Reddit and 4chan.

Well... sometimes the only difference seems to be that you cannot attach pictures to your comments. (still - depends on the subreddit)
Post reply on HN