Show HN: Embed Full-Page Screenshots in any Blog / App / Whatever

you are basing your 'token' on md5(data+secret), however md5 (and other hash functions) are easily extended when data and token are known, even without knowing secret. Basically, given data and token, I can produce a different token, that matches a (somewhat) different data, without knowing secret.

Re: Show HN: Embed Full-Page Screenshots in any Blog / App / Whatever

#7

Post by dherken » Wed, Mar 06, 2013, 8:49 PM UTC

mmmooo wrote: post #6

dherken wrote: post #5

Earlier quoted context omitted.

What exactly do you mean?

you are basing your 'token' on md5(data+secret), however md5 (and other hash functions) are easily extended when data and token are known, even without knowing secret. Basically, given data and token, I can produce a different token, that matches a (somewhat) different data, without knowing secret.

Sure you could, but then why would one go through all the hassle just to get a (probably already cached) screenshot?

Re: Show HN: Embed Full-Page Screenshots in any Blog / App / Whatever

#8

Post by thinker » Wed, Mar 06, 2013, 8:51 PM UTC

Does it let you take a screenshot of the whole height of the page? I see that you can specify the height of the viewport, but what if I want a whole long screenshot of as much height is rendered?

Re: Show HN: Embed Full-Page Screenshots in any Blog / App / Whatever

#9

Post by dherken » Wed, Mar 06, 2013, 8:55 PM UTC

thinker wrote: post #8

Does it let you take a screenshot of the whole height of the page? I see that you can specify the height of the viewport, but what if I want a whole long screenshot of as much height is rendered?

Yes it does. See this example of the nytimes: http://url2picture.com/Picture/Png/?apikey=6101EE5C99B145ECB...

Of course there are limits to this as some websites have "endless" scrolling (like pintrest)

Re: Show HN: Embed Full-Page Screenshots in any Blog / App / Whatever

#10

Post by mmmooo » Wed, Mar 06, 2013, 8:57 PM UTC

dherken wrote: post #7

mmmooo wrote: post #6

Earlier quoted context omitted.

you are basing your 'token' on md5(data+secret), however md5 (and other hash functions) are easily extended when data and token are known, even without knowing secret. Basically, given data and token, I can produce a different token, that matches a (somewhat) different data, without knowing secret.

Sure you could, but then why would one go through all the hassle just to get a (probably already cached) screenshot?

well, for starters, I could use your (paid) account to get free screenshots.