|
|
Photobucket privacy hole patched
Author: Gareth HalfacreePublished: 15th July 2008
The flaw in the Photobucket site, which revealed private photos to a determined adversary, has been fixed.
According to CNet, which appears to be taking the credit for alerting Photobucket about the issue, the problem was discovered by a Vancouver (that's California, not Canada) computer tech by the name of Byron Ng. Armed with the user identifier of a Photobucket member and the knowledge of at least one filename in their private album – by far the hardest bit of information to glean – it was possible for users to manually enter a URI for a private album page, and from there navigate to any other file within the allegedly 'private' album.
After CNet contacted Photobucket in the morning on Monday, a fix was rolled out that prevented such known-filename attacks that afternoon. Whether that's because CNet contacted Photobucket I leave to the reader to conclude; a statement from News Corp, the corporate overlords of both Photobucket and popular social networking site MySpace, simply states that the issue has been resolved “less than 24 hours after the site was made aware of the issue,” which certainly sounds like CNet was beaten to the punch.
While improved privacy on such sites is to be applauded, I can't help but question why someone would upload their pictures to a photo-sharing site and then mark them as private? Perhaps I'm just not switched on to this Web 2.0 world we live in, in which we have ever-increasing amounts to show to an ever-shrinking audience.
What's your take on this – was it a critical flaw in the design of the site, or do you agree that 'private' photos should never have been uploaded to a third-party website in the first place? Share your thoughts over in the forums.
Related articles on bit-tech.net
Comments (17)
Stats: 0.074 seconds
i usually only upload Untitled.jpg file because im too lazy. first uploaded a Untitled.jpg, then deleted it, and a few days later, uploaded another Untitled.jpg. because the first one doesn't exist, the latter gets put on without renaming. going back to a forum, i discovered that the newly uploaded photo gets shown instead of the not-found mini-picture.
What? You think everyone has their own personal (1st party) host server which they can upload to and their friends around the world can access at any point?
simply put, setting your album to 'private' means people can't browse it, but if you embed an image in a forum from that album, everyone can see it. you can also give people the password to the album so they can browse it, without all the riff-raff seeing what's inside.
You're totally wrong here because some pictures are absolutely private and no responsible person would host them on a 3rd party hosting service that can be easily hacked.
I'm sorry, I don't understand your argument.
you know you can use sites like photobucket to store pictures so that you can get them from any other computer that has internet access (I know USB memory sticks make this somewhat redundant). you can also use photobucket for backing up your photos as it hold 1GB (I thought it was 5GB, but just checked and it's now 1GB :\ ). there is a lot you can do with it aside from the standard storage for forum images.
If there is an accident which The Photobucket team will promptly apologize for..
That's like saying backing up Government data on a(n ordinary) hard drive is a no-go because the data can become corrupted during defragging.
no, but i think if u need to show your friends a bunch of important event pictures, you can just email them or burn them a CD or lend them ur usb kit or somethin... anything BUT 3rd party online host that are accessible to the public...
IMHO anyway...