Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

reddit.com

Post reply on HN
Print view View original

31–40 of 60 posts

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#31

Post by jrockway »

cryptnoob wrote: post #20
mseebach wrote: post #15

Earlier quoted context omitted.

Less than six months ago, some internal (non-confidential, non-critical, but, none the less, internal) documents of a client of mine showed up on Google. The reason? They were public files in a folder on the webserver, and someone turned on Indexes in Apache. It is the exact same problem. Not even the shadow of a cloud (pun intended) was involved.

I just had google index my ajax directory. I have a directory where I keep ajax files. The only link to them is through my javascript ajax calls. I was pretty surprised that Google goes through your javascript, harvesting your ajax links.

Well, you linked to them via JavaScript. The whole rest of the Internet might not have been that careful, though.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#32

Post by zengyro »

prog wrote: post #12
frognibble wrote: post #3

The founder of the company responded on the Reddit thread: http://www.reddit.com/r/pics/comments/bjezp/massive_privacy_... The application is described in the iTunes store: http://itunes.apple.com/app/quip-free-photo-texting/id291358...

Interestingly this flaw was reported in 2009 on Digg. http://digg.com/security/Quip_TXT_for_iPhone_FAIL_WIN_NSFW I am not sure if QuitTxt tried fixing it that time.

4Chan/b picked up on it yesterday, turning something that hummed below the radar for a few months into a gargantuan cluster-frack.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#33

Post by jcromartie »

DrJokepu wrote: post #24
jcromartie wrote: post #9

Earlier quoted context omitted.

People don't change. Everybody is a pervert or a sadist or something. Everybody does something weird when they think nobody is looking. The population is growing, and so there is certainly more going on at any one time, but I doubt the portion is really growing.

To be fair, sending naked photos of yourself over the phone to your partner is hardly "pervert or sadist or something", maybe a bit kinky but that's it.

I was trying to infer that making fun of people from behind the Internet veil of anonymity is sadistic, and it's a temptation for a lot of people at some point or another.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#34

Post by roc »

DanielBMarkham wrote: post #6

Two things in this story that are not new, but still amazing to me. 1) A significant portion of people love taking pictures of themselves naked. This portion seems to be growing. 2) Another significant potion of people love publishing and making fun of people for whatever reason they can find. These people will dig through your trash, hack your servers, socially-engineer your passwords, etc. The more they can publicl…

RE point 1)

That phones have put personal private cameras in more hands than even Polaroid certainly contributes. But I think a 30, 50 or 100% increase in cameras is nothing compared to the exponential increase in perfect digital copies and transfers of any given image.

The evidence can no longer be counted on to get lost, get damaged, decay, etc - and it duplicates and multiplies as a default behavior at every step of an exchange.

1 naughty polaroid = 1 naughty image

1 naughty cell-phone pic = 1 pic on camera, 1 pic on home PC, 1 pic in thumbnail cache, 1 pic on flickr, 1 pic in uploader's browser cache, 1 pic in recipient's browser cache, 1 pic on recipient's machine, 1 pic in recipient's thumbnail cache, etc.

Even if an image is never intentionally distributed, it's effectively distributed.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#35

Post by oogali »

I did a similar service (pktpix) about two years ago, but I used MD5 hashes. Easily guessable URLs were the first thing I thought about.

I figured since these messages were being passed around via txt, forwarded e-mails, etc., there was no real benefit in shortening them.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#36

Post by cryptnoob »

jrockway wrote: post #31
cryptnoob wrote: post #20

Earlier quoted context omitted.

I just had google index my ajax directory. I have a directory where I keep ajax files. The only link to them is through my javascript ajax calls. I was pretty surprised that Google goes through your javascript, harvesting your ajax links.

Well, you linked to them via JavaScript. The whole rest of the Internet might not have been that careful, though.

No, this is a brand new site, on it's first index through Google. I'm very confident that they went through the JS. Nobody else had any link to the site at all yet. Not really on topic, here, but the parents comment inspired me to share.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#37

Post by brlewis »

prog wrote: post #10

So what happens to QuipTxt now?

If the past is any indication, they fix the hole and everybody forgets about it. Then Quiptxt grows to hundreds of millions of users, just like that other site that used only 4 random digits: http://www.allfacebook.com/2009/02/facebook-photos-warning/

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#38

Post by alecco »

gcanyon wrote: post #26

A thought experiment for the large minds here: how long a string _would_ be sufficient? I wonder if any string is long enough if you don't also implement some sort of access control lockdown to prevent people poking your system endlessly, but what do you think?

Security and privacy shouldn't be based on hiding a plaintext string. What about the ISPs, browser history, and other leakage.

S3 hosting of private images was a terrible idea. It doesn't provide any kind of protection.

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#39

Post by daleharvey »

gizmo wrote: post #18
daleharvey wrote: post #11

Earlier quoted context omitted.

if you only need to guess something address to see it, it is public

The average Google Docs link has more entropy than the average username/password combination. So unless you want to argue that everything online is public to some extent, I don't think your claim makes much sense.

the google docs links arent stateless logins, you cant login to google as me because you guessed the hash of my word doc (or more likely, I gave it to you).

Re: Thousands of private fotos leaked, privacy disaster for Quiptxt.com users

#40

Post by daleharvey »

cryptnoob wrote: post #17
daleharvey wrote: post #11

Earlier quoted context omitted.

if you only need to guess something address to see it, it is public

I disagree. A password is not a magic spell. It's a set of letters and numbers that, if guessed correctly, will give me access to something you wanted kept private. An obfuscated URL is a set of letters and numbers that, if guessed correctly, will give me access to something you wanted kept private. Because one uses a MySQL database, and the other uses a file system, is irrelevant. They are functionally identical whe…

its not about filesystem vs database, where the data is stored is arbitrary, its about how much information you need to access it, apart from the increased entropy in using 2 bits of information (a username + a password (depending on the link size)), you can also implement things like locking accounts when someone guesses the password wrong X times, something that is impossible with a single entry point.
Post reply on HN