Apparently the popular photo sharing site Smugmug has a huge security hole that could allow anyone with a bit of common sense to access private photos on Smugmug. The basic problem here is that Smugmug uses URL’s for public and private galleries in a way that can be easily guessed. And whats even more shameful is that the people behind the site are aware of this issue, but they seem to be too keen to say that this is intended behavior.

If seeing private photos via publicly accessible URL’s is what you call intended behavior then I have nothing else to say to the Smugmug team..

Let me take an example here, when I typed in http://www.smugmug.com/gallery/1021 into my browser, i was looking at a collection of photos that were perhaps not meant for people like you and me to have a peak at. Ofcourse Smugmug has other features like password protection, but I’m sure that most users would take password protection as an added trouble in making photos private. They probably think that by marking them as private, no one else except them could see it. But things don’t work that way at Smugmug.

This hole was discovered by Google Blogoscoped and here is what the CEO of Smugmug Don MacAskill had to say to Google Blogoscoped :

“…we view security and privacy as two separate, but related, issues. Security is like locking your front door (no-one can get in with out a key) and privacy is like closing your window drapes (no-one can look in from the outside, but you can tell people where you live and they can visit without a key).

At SmugMug, the feature you’re talking about, private galleries, falls under the privacy umbrella, not security. It’s intentionally designed so that you can “tell other people” about your photos (share a URL in an email, embed or hyperlink on your blog or message forum, etc) without having to share something like a password. Only people you’ve shared this URL with can find the gallery and/or photos in question.

But the URL’s that Smugmug generates for their private photos can easily be guessed and anyone who’s got a little bit of common sense could figure it out and look at photos they aren’t supposed to be seeing. A possible alternative for Smugmug would be to use URL’s like the ones Flickr uses that is based on the GUID of the image.

Have a look at these URL’s (these are private photos):

• On Flickr : http://flickr.com/photos/21355799@N02/2202765901/in/set-72157603746681202/
• On Smugmug : http://www.smugmug.com/gallery/1021

Things clearly aren’t looking good for Smugmug here. Someone could develop a bot that would download all private images from Smugmug and put it for everyone else to see, something that happened recently with Myspace.

Via Google Blogoscoped

• 123Flickr

123Flickr is a gallery creating utility that generates code for you to insert a cute Flickr gallery in your website. It is available at 123Flickr.com. It is not restricted to your own pictures, and you can create galleries from any Flickr picture set or Flickr user you have an interest in. It does not work (yet) with Flickr collections.

First, you will have to find a user or a picture set that you like in Flickr. Let’s take our Countries in Colors Flickr account as an example. You simply copy the name of the user (in our case countries in colors) and paste it into the username dialog that appears on the first page at 123Flickr.

Second you determine the number of pictures that should appear in your gallery. Be mindful not to add too many images as this slows down loading when you will access your page.

Look at the demo below :

• Slideflickr

Slideflickr touts that it “will help you create and embed Flickr slideshows in less than 10 seconds”. Simply type in a username, user, group, or a set URL on Slideflickr’s homepage, hit enter, and you receive a url to copy and paste on your website. When entering the “countries in colors” username, the result looks like this:

The standard size of the slideshow window is a 500 by 500 pixels square, but you can easily customize this by modifying the simple code you pasted by for example reducing it to 400 by 400 as I did in the above example. Better still, you can click on the “advanced options” tab and customize the appearance of your slideshow in various ways: window size, customize text messages, background color, speed, enter a custom logo text and url link, or even add a background music.

But Slideflickr’s versatility does not end there: you can also select the content of your slideshow by set, tags or favorites. The only downside of Slideflickr is that it is but a nice interface to Flickr’s standard slideshow. It does not create any new slideshow template or transitions.

P.S : RSS Readers if you can’t see the slideshow please visit this page..

• Download and install the application from the AIR file.
• Once you have installed and launched the application, enter the flickr account ID of the account that you want to download the images from.
• Note that this is the Flickr account ID and not the account user name.
• You can find a user id for a specific account here.

Once you have specified the flickr user id, then you can optionally specify the folder that the images will be downloaded into. By default, images will be downloaded into a directory named flump on the desktop.

Here is a screenshot of flump :

So go ahead and download flump today. Before installing make sure you have Adobe Runtime (AIR) Installled.