11–20 of 143 posts
Excellent find. You can even access around 25 photos from Mark Zuckerberg's profile. http://imgur.com/a/PrLrB (ps: what a nice photo of them on halloween. very generous too I can see!)
Interesting that those are full-sized. It appeared in the forum post to only be giving access to thumbnail resizes of the original images.
If that doesn't prove that FB's developers aren't thinking about security, I don't know what would. Nobody who is in a culture of protecting security would even consider building this.
It would seem based on the screenshot ("Message x to ask them to remove the photo...") that they must have specific permissions set to cause this to work as I can't replicate on people that I can't message.
I disagree. You can message people that you aren't friends with. See the first screen shot ("add her as a friend or send her a message"). I think the reason it only works on some profiles it that perhaps the profile pictures are the only ones that it will show you. And some people only have one profile photo. (This is an untested theory / guess.)
Earlier quoted context omitted.
Interesting that those are full-sized. It appeared in the forum post to only be giving access to thumbnail resizes of the original images.
Apparently, you can change a char in the thumb URL to get the full size image URL.
Edit: it appears this same char is available in both URI formats I was referring to, so yes, full-size images are exposed.
If that doesn't prove that FB's developers aren't thinking about security, I don't know what would. Nobody who is in a culture of protecting security would even consider building this.
Or privacy. The assumption here is that if someone thinks you have an inappropriate photo, you now have no right to privacy?
Nice find.
If that doesn't prove that FB's developers aren't thinking about security, I don't know what would. Nobody who is in a culture of protecting security would even consider building this.
Or privacy. The assumption here is that if someone thinks you have an inappropriate photo, you now have no right to privacy?
However, someone had to implement the backend for listing out those photos, and they clearly didn't think of access control, so there's at least something fishy here…
Earlier quoted context omitted.
Interesting that those are full-sized. It appeared in the forum post to only be giving access to thumbnail resizes of the original images.
Apparently, you can change a char in the thumb URL to get the full size image URL.
[quote] right click inspect the image copy url in another window change the 'a' to 'n' (the last one right before jpg) =fullsize original image [/quote]
Seems to be already fixed. The last option described in this tutorial is not there anylonger.
Reading the thread, it seems that it doesn't work for all accounts and there is speculation it only works if you have us english locale.