Facebook Plunges Again
Tumblr 101: Tips And Tricks To Get Started
SmugMug doesn't seem to understand the meaning of privacy
Sure, a password would make the page more secure, but it would also make it more inconvenient for your friends, family, and colleagues to see your vacation photos. But as long as there's no easy way for the general public to find your photos, they're still secure from prying eyes, right?
Maybe not. The problem is that SmugMug gives images a predictable URL string, starting with http://www.smugmug.com/gallery/1000. All you have to do is change the number and you'll start to find photo album after photo album, whether they're market public or private.
As Google Blogoscope's Philipp Lenssen points out, the solution could be as simple as using a random string of characters. But the CEO of SmugMug replied in an email to Lenssen that the system wasn't built for randomized strings, and changing it now would be expensive. And you know what? If most SmugMug users remain blissfully unaware that their "private" images might be publicly accessible then maybe it's not wroth the time and money to fix the flaw. But we kind of think SmugMug and any other company that claims to offer users some level of privacy should really be willing to improve their system when flaws are pointed out.
Comments
5
Subscribe to commentskevjohnJan 28th 2008 12:48PM
That's just sloppy, SmugMug.
I wonder if changing the gallery number to view the different 'private' albums will be considered to be a form of hacking in N. Dakota.
Erik AndersonJan 28th 2008 2:10PM
While I agree that this is somewhat sloppy, this type of privacy, even when using random strings, falls into the "security by obscurity" umbrella. If people *really* want their pictures to be private, apply a password.
RocketboyJan 28th 2008 2:39PM
Shades of the MSN Groups Magic Link...
Barnabas KendallJan 28th 2008 5:12PM
I posted a workaround for SmugMug's "problem" in my blog, and it isn't as expensive as the previously proposed solution:
http://barnabas.wordpress.com/2008/01/28/plugging-smugmugs-hole/
They don't have to convert to random characters (or GUIDs), but they should do something. This is a PR disaster waiting to happen, as MySpace recently found out.
GregJan 30th 2008 1:49PM
I agree with KevJohn- this issue does seem sort of sloppy. You would think that with issues like Facebook’s privacy that other sites (competitors even) would tidy up on the privacy settings and even promote a stronger privacy policy. In today’s online world, a solid privacy and security policy could be a huge competitive advantage.