Smugmug Private Photos are for Anyone to See

Apparently the popular photo sharing site Smugmug has a huge security hole that could allow anyone with a bit of common sense to access private photos on Smugmug. The basic problem here is that Smugmug uses URL’s for public and private galleries in a way that can be easily guessed. And whats even more shameful is that the people behind the site are aware of this issue, but they seem to be too keen to say that this is intended behavior.

If seeing private photos via publicly accessible URL’s is what you call intended behavior then I have nothing else to say to the Smugmug team..

Let me take an example here, when I typed in http://www.smugmug.com/gallery/1021 into my browser, i was looking at a collection of photos that were perhaps not meant for people like you and me to have a peak at. Ofcourse Smugmug has other features like password protection, but I’m sure that most users would take password protection as an added trouble in making photos private. They probably think that by marking them as private, no one else except them could see it. But things don’t work that way at Smugmug.

This hole was discovered by Google Blogoscoped and here is what the CEO of Smugmug Don MacAskill had to say to Google Blogoscoped :

“…we view security and privacy as two separate, but related, issues. Security is like locking your front door (no-one can get in with out a key) and privacy is like closing your window drapes (no-one can look in from the outside, but you can tell people where you live and they can visit without a key).

At SmugMug, the feature you’re talking about, private galleries, falls under the privacy umbrella, not security. It’s intentionally designed so that you can “tell other people” about your photos (share a URL in an email, embed or hyperlink on your blog or message forum, etc) without having to share something like a password. Only people you’ve shared this URL with can find the gallery and/or photos in question.

But the URL’s that Smugmug generates for their private photos can easily be guessed and anyone who’s got a little bit of common sense could figure it out and look at photos they aren’t supposed to be seeing. A possible alternative for Smugmug would be to use URL’s like the ones Flickr uses that is based on the GUID of the image.

Have a look at these URL’s (these are private photos):

• On Flickr : http://flickr.com/photos/21355799@N02/2202765901/in/set-72157603746681202/
• On Smugmug : http://www.smugmug.com/gallery/1021

Things clearly aren’t looking good for Smugmug here. Someone could develop a bot that would download all private images from Smugmug and put it for everyone else to see, something that happened recently with Myspace.

Via Google Blogoscoped