Facebook security hole allows viewing of private photos • Hacker News Board

Re: Facebook security hole allows viewing of private photos

#41

Post by TeMPOraL » Tue, Dec 06, 2011, 2:27 PM UTC

slig wrote: post #11

llambda wrote: post #10

Earlier quoted context omitted.

Interesting that those are full-sized. It appeared in the forum post to only be giving access to thumbnail resizes of the original images.

Apparently, you can change a char in the thumb URL to get the full size image URL.

To get the full, full size image try changing from _n to _o. I haven't checked it on the links exposed by discussed method (I'm going to work in a minute), but it's how "Download" link for photos works on normal Facebook photo browser - if you upload a high-resolution picture to Facebook, it's available with _o in the name.

Re: Facebook security hole allows viewing of private photos

#42

Post by Zhenya » Tue, Dec 06, 2011, 2:46 PM UTC

Boy, I wonder what the FTC will say about this...

Re: Facebook security hole allows viewing of private photos

#43

Post by speg » Tue, Dec 06, 2011, 2:50 PM UTC

CWuestefeld wrote: post #7

If that doesn't prove that FB's developers aren't thinking about security, I don't know what would. Nobody who is in a culture of protecting security would even consider building this.

That's why their philosophy is 'Move fast and break stuff'. The alternative might be a slow moving bureaucracy that never iterates new features.

Re: Facebook security hole allows viewing of private photos

#44

Post by digitalsushi » Tue, Dec 06, 2011, 2:51 PM UTC

Don't do it, kids. You'll find photos of that girl you pined for 2 years after you never made your move and she's way more fun and in way better shape than you ever guessed. It's rough to ruin the fantasy, but torture to augment it.

Re: Facebook security hole allows viewing of private photos

#45

Post by tantalor » Tue, Dec 06, 2011, 2:51 PM UTC

Archio wrote: post #17

This isn't even a security hole, it's a complete security disaster. Did they even think through the process for five minutes before they built that? I mean, there aren't even any hacks involved. Nice find.

> there aren't even any hacks involved

I doubt law enforcement would see it that way. Downloading photos with this method is not much different than guessing somebody's email or voicemail password; you're accessing something you're not supposed to.

See 18 U.S.C. § 1030(a)(2)(C) and § 2701.

Re: Facebook security hole allows viewing of private photos

#46

Post by marquis » Tue, Dec 06, 2011, 2:55 PM UTC

ianhawes wrote: post #23

This is a security hole and nothing more. Developers make mistakes. This is not some vast conspiracy by Facebook to undermine your privacy. Why, of all places, is HackerNews unable to comprehend this?

Is Facebook not hiring some of the most talented developers in the industry? This is a ridiculous mistake that should have been tested for prior to production.

Re: Facebook security hole allows viewing of private photos

#47

Post by rodion_89 » Tue, Dec 06, 2011, 2:56 PM UTC

baha_man wrote: post #37

einhverfr wrote: post #12

Facebook is an excellent personal marketing tool. However, I think at this point you'd have to be a fool to put material on it you want to be private. Of course, what PT Barnum said....

"Of course, what PT Barnum said..." Or possibly didn't say: http://en.wikipedia.org/wiki/Theres_a_sucker_born_every_minu...

It looks like HN removed the apostrophe so here is a bit.ly version that works.

http://bit.ly/kyYCxk

Re: Facebook security hole allows viewing of private photos

#48

Post by kmfrk » Tue, Dec 06, 2011, 2:59 PM UTC

This is how many days after the FTC settlement?

Re: Facebook security hole allows viewing of private photos

#49

Post by sp332 » Tue, Dec 06, 2011, 3:04 PM UTC

nyellin wrote: post #34

Archio wrote: post #24

Earlier quoted context omitted.

I think it's a stretch to call this "just" a mistake. First of all, there isn't any malicious code that has to be run to execute it, it's a simple as clicking a few buttons in the UI. Secondly, Facebook is a site with hundreds of millions of users managing billions of private photos. With the amount of revenue & number of developers they have, it's inexcusable that they can't think through a simple process like this…

I'm downvoting you for saying I think it's a stretch to call this a mistake If it wasn't on purpose, it was a mistake. Period. It might be inexcusable, as you later pointed out, but it was still unintentional. Everyone likes to hate on Facebook. If this was a YC startup, I suspect people would be more forgiving.

There is such a thing as criminal negligence.

Re: Facebook security hole allows viewing of private photos

#50

Post by Archio » Tue, Dec 06, 2011, 3:12 PM UTC

tantalor wrote: post #45

Archio wrote: post #17

This isn't even a security hole, it's a complete security disaster. Did they even think through the process for five minutes before they built that? I mean, there aren't even any hacks involved. Nice find.

> there aren't even any hacks involved I doubt law enforcement would see it that way. Downloading photos with this method is not much different than guessing somebody's email or voicemail password; you're accessing something you're not supposed to. See 18 U.S.C. § 1030(a)(2)(C) and § 2701.

Well, the question is, how far does that go? If I put up photos on a public web server intending them to be private, is that still legal?