51–60 of 60 posts
This is why you shouldn't sent or say over the internet anything that you wouldn't show your mother and why you should try to keep your private life separate from your internet live. If I was a user I would never again use this service. This wasn't even a security flaw it was plain incompetence as some redditors mentioned.
It would also include other services by the same management to the list :-)
A thought experiment for the large minds here: how long a string _would_ be sufficient? I wonder if any string is long enough if you don't also implement some sort of access control lockdown to prevent people poking your system endlessly, but what do you think?
A thought experiment for the large minds here: how long a string _would_ be sufficient? I wonder if any string is long enough if you don't also implement some sort of access control lockdown to prevent people poking your system endlessly, but what do you think?
You can add an option to delete/rekey the image too. At that point the URL is exactly as secure as the method you use to send the URL -- just like a password.
Seems they had no security at all (just a random 5 character hash).. Reddit users are seemingly busy sharing nsfw pictures and linking them to facebook accounts, will probably result in a couple of suicides when all is said and done :(
It's interesting how quickly the wolves jump on an easy target. Some of the comments on reddit and elsewhere I've read are talking about making throw-away Facebook accounts to confront/embarrass people with their private pictures. I've already seen a few names posted. I'm willing to cut people some slack for looking at the pictures (a harmless crime, human nature) but doing the leg work to connect anonymous pictures…
I like reddit so I'm a little saddened to see this behavior there but this is another reminder that the internet isn't as segregated as we think it is. Reddit is no gated community. Its best and worst feature.
A thought experiment for the large minds here: how long a string _would_ be sufficient? I wonder if any string is long enough if you don't also implement some sort of access control lockdown to prevent people poking your system endlessly, but what do you think?
Doubling the characters to 10 would pretty much completely solve the problem. It would take many, many years to find a single image. Far below the threshold where Amazon S3 would ban you.
Two things in this story that are not new, but still amazing to me. 1) A significant portion of people love taking pictures of themselves naked. This portion seems to be growing. 2) Another significant potion of people love publishing and making fun of people for whatever reason they can find. These people will dig through your trash, hack your servers, socially-engineer your passwords, etc. The more they can publicl…
1) ... of which a significant portion is underage. I wouldn't be comfortable hosting such a service. 2) It's not clear to me this portion of the population is growing, but it does bother me that those people don't get the disdain they deserve (according to me). That said, I think the company in question should be held liable for these kind of breaches. It's your responsibility as an online service to protect the priv…
Seems they had no security at all (just a random 5 character hash).. Reddit users are seemingly busy sharing nsfw pictures and linking them to facebook accounts, will probably result in a couple of suicides when all is said and done :(
Do not confuse Reddit and 4chan.
Earlier quoted context omitted.
If you launch something like QuipTxt, make it obvious to people that their images are public Google Picasa stores images as public URLs without any such warning. Because with random URL's, you effectively have passworded each image. Even more secure than if they were all locked into a nice MySQL database, because then they would all be behind only a single password. I think you don't have to freak out users with too…
if you only need to guess something address to see it, it is public
A thought experiment for the large minds here: how long a string _would_ be sufficient? I wonder if any string is long enough if you don't also implement some sort of access control lockdown to prevent people poking your system endlessly, but what do you think?
Security and privacy shouldn't be based on hiding a plaintext string. What about the ISPs, browser history, and other leakage. S3 hosting of private images was a terrible idea. It doesn't provide any kind of protection.
S3 offers privacy protections with the ability to require an expiring token in the URL. The theory is the web site should authenticate a user, and only generate a valid token for that user (for a fuzzy definition of "that" user) that works only for a limited time.