17

In the Flickr privacy settings page there's a setting entitled "Who can access your original image files?". If I set this to anything other than "Anyone" (e.g. "Only you" or "Your contacts"), is it still possible for an unauthorised user to access the original image without someone giving them the URL for it? (Assume that my original photo is larger than 1024px, so there's an Original version distinct from the Large version. Also assume it's not Creative Commons licensed.)

I'm well aware that once an image has appeared in their browser, a determined user can easily download it regardless of any disincentives (e.g. JavaScript blockers) the browser tries to put in their way. However, I believe the following are correct:

  1. An unauthorised user will just see an error page if they try to view the Original Size page on Flickr (e.g. this page).

  2. Although the URL of that page is easily guessable (just add sizes/o/ to the end of the regular photo page URL), the URL of the actual original image file has a random component and cannot easily be guessed.

There are plenty of people on Flickr and elsewhere saying the disable download setting is useless, but I haven't seen any proof. Does anyone know for certain that it can be bypassed? If you say yes, I'll expect you to prove it by sending me the original size of my latest image! (It's meant to be available to friends & family only - so not you, Uncle Goober...)

Some context: I should point out I'm not looking to steal photos, I'm trying to understand how safe mine are, specifically with regard to this geofences loophole that was reported today.

Improve this question
  • 2
    Please note this isn't a programming question: I'm not asking how it can be done. It's a photography question: I want to know if my images are secure on Flickr or if there's evidence out there to the contrary. – Mark Whitaker Aug 31 '11 at 17:29
  • I can download any image you allow us to see, so that's fairly useless to try an block. Without devoting time to attempting hack Flickr (and risking my account and, well, jail) it's not specifically easy to say if your original can be retrieved without permission. – John Cavan Aug 31 '11 at 17:31
  • @John Yes, your first sentence is correct - I stated the same in my question. I'm not asking anyone to try hacking Flickr, just wondering if anyone's seen news of a known vulnerability out there. – Mark Whitaker Aug 31 '11 at 17:36
  • @Mark, good question. – b w Aug 31 '11 at 17:40
18

I did some investigation on my own, using my own flickr account and a non-logged in browser.

Here's the All Sizes page for one of my photos.

Prior to me changing the "Who can access your original image files?" setting in Privacy & Permissions, a generic Internet user could see the "Original" link in addition to the other sizes. That page had an <img> tag that linked to this url. The "All Sizes" page also had a link that said Download the Original size of this photo. (If you check the URLS, note that there's a _d suffix on the file name; Flickr will see this and trigger the HTTP header that tells the browser to download instead of display the image).

For comparison, here's the Large size page and the corresponding image URL.

Then I changed the privacy setting, cleared the cache on my non-logged-in browser, and recheceked the links. Here's what I found:

  • The link to the original size page now redirects to the large size page. That's reasonable.
  • The All Sizes page didn't have the Original size links any more, as expected.
  • I was still able to download the original size image
    • This is a bit surprising. It means that, while there's access restrictions on the pages containing the images, theres no security on the images themselves.
    • As a web developer I can understand why they probably did this. The images are large and static and probably served via a content delivery network. It's faster/more efficient to not check permissions for image files; you can simply host them on a "dumb" web server that way.

So, once the URL for the original file is known, there's no way to stop someone from downloading the original version of the file (short of deleting it entirely... and that may not even work. I didn't try).

One last issue: how guessable are the original file URLS? Here they are side-by-side:

Large:    http://farm7.static.flickr.com/6126/6044833128_cc02cf41e3_b.jpg
Original: http://farm7.static.flickr.com/6126/6044833128_3b8eac89d7_o.jpg

So, the suffix (_b or _o) determines the size, but there's also another element in the filename that varies depending on the size. You can't just change the suffix to flip sizes. Here's the URL for the Large version with the suffix switched to _o; it doesn't work.

If I was Flickr, I'd make sure that that middle element was completely random per photo size, and hence unguessable except by brute force attack. It's 40 bits long, so there's a lot (2^40, ~1 Trillion) of possible options. It's very unlikely anyone would bother to brute-force that segment just to get the original size version of a file... when they already have the large version.

So, as long as you've turned off the "Original file download" feature and you don't share the URLs of the original images, I'd say that the Flickr feature is pretty secure. If it breaks, it's pretty much your own fault.

Improve this answer
  • 6
    There's one exception to my "it's your own fault" conclusion. As @Imre mentioned, Flickr typically uses non-secure HTTP connections, which means that anyone between your browser and Flickr (your company, your ISP) can listen in on your URLs. If you browse the Original Size page, you'll get the original-size-image URL; an attacker could sniff this and save the URL. However, if someone is listening in on your HTTP traffic, IMO you have bigger problems than keeping your Flickr originals safe. – Craig Walker Sep 1 '11 at 13:55
  • Thanks for providing the links, I was able to verify the caching headers now! – Imre Sep 1 '11 at 14:27
  • 2
    You don't even have to browse your Original Size page; browse anything on Flickr and the sniffer can help himself with the session cookie you just used. – Imre Sep 1 '11 at 15:05
  • 2
    That's a great answer: +1 for your analytical approach and clear explanations. I did know that the original image URL is unauthenticated (i.e. available to anyone with the URL) - that's implied in my question ("is it still possible [...] without someone giving them the URL for it?") but thanks for mentioning it explicitly. :) – Mark Whitaker Sep 1 '11 at 17:55
  • @Mark Whitaker: You're very welcome. I did want to make clear the difference between the URL of the image and the URL of the page that contained the image... especially as the one does have permissions attached. – Craig Walker Sep 1 '11 at 18:09
3

This page (linked to from the Firefox plugin that bill weaver posted) does a good job of summarising the situation, including the "random component" in the image URL that I mentioned in the question.

The author notes:

This means that even if you go to the trouble of getting the file name for one of the smaller sizes, you cannot guess the file name of the original photo, and this is great news for photographers worried about image theft.

"Cannot guess" - great! :) But then he goes on to say:

The cool thing is that after Flickr randomized the file names, it became next to impossible to guess the URL for a file’s original size.

"Next to impossible" - not so great! :( But I assume he just means that given enough time and processing power you could crack it with a brute-force attack. If so, that's good enough for me: I'll take those odds. :)

Improve this answer
  • 2
    i wouldn't be worried about a brute-force attack on a single image you post (that's not to say they're not worth it :). The bigger concern (for me, at least) is if some other hole is discovered, someone at flickr makes a mistake and leans on the wrong lever, or they change their policies (due to a change of heart, an acquisition by people with other ideas, etc). – b w Aug 31 '11 at 18:03
  • 2
    next to impossible should probably be intended like it is not strictly impossible but cracking the random number generator would require either some serious flaw in the random gen itself (not impossible, something similar unfortunately happened I think with Debian, see debian.org/security/2008/dsa-1571 ), probably requiring in the process a conspicuous number of guesses which the flickr server should detect as suspicious. – Francesco Aug 31 '11 at 20:18
  • Now you're in the realm of effort/risk to reward and I doubt there is much on Flickr that would warrant the risk. That's not an assesment of image quality, it's just an assesment that re-creating the image may be less effort and much less risk. It's been done, too, by the advertising industry. – John Cavan Sep 1 '11 at 3:01
3

Flickr uses non-secure web protocol (HTTP) by default, so any images can be accessed after performing session hijacking from a person who can access them. For session hijacking, the attacker needs to be able to eavesdrop on victim's network traffic, e.g. by accessing same wireless access point or some intermediate network node. The risk has become quite significant in public wireless spots after Firesheep was released - a Firefox plugin that automatically grabs cookies other people use in the same wireless area and presents them for easy use.

Also, the images come with headers that allow intermediate web caches to keep them for years. So getting access to browse a web cache might also provide access to original images that have been viewed through that cache.

I am not going to chase down your or your friends' network connection or caches, so no, I am not going to send you your original image. But to play safe, your best bet is not to upload original images.

Improve this answer
  • 4
    Photo.SE also uses HTTP, so actually this post may have been written by somebody else than me :) – Imre Sep 1 '11 at 13:05
2

If it's displayed, of course you can save it. If originals are protected, then not unless the URL is known. Bottom line is pretty secure and no i don't think it can be downloaded.

The flickr-original firefox plugin seems at first to do this (i passively assumed so), but actually downloads the large size if you've protected your originals from public viewing. I've downloaded a 1024 x 580 version of your photo with this plugin.

Improve this answer
  • Not if the original is set to not allow it. The URL hack has been removed, it just bounces you to the largest available now. That's what the plugin author states as well. – John Cavan Aug 31 '11 at 17:33
  • 1
    Hmmm... yes, you're correct, @John. I said "purport" judging only on the "original" in the plugin name. :) – b w Aug 31 '11 at 17:37
  • @bill You've downloaded a 1200px original image? I don't think so: that page you linked to states "Caveats: This won't work on images that the photographer has marked 'All Rights Reserved' or has disabled downloading." It may have let you have a 1024px Large version but the question relates very specifically to the Original size. – Mark Whitaker Aug 31 '11 at 17:40
  • 1
    @Mark, as i said, i downloaded the 1024 x 580 image. Maybe i jumped the gun and my initial pass at an answer didn't state that. But, yes, 1024 is what it downloaded. – b w Aug 31 '11 at 17:41
  • 1
    It would appear so, yes. :) From what i can tell, flickr takes your ownership of an image pretty seriously and carefully walks the fine line between sharing, public access, and your rights. Opinions differ on that, and they make mistakes, but that's my overall take. On the other hand, i don't trust this enough to upload my original images. – b w Aug 31 '11 at 17:46
-1

Firefox plugin Tamperdata will allow the discovery of the protected url for the image. It is trivial to do so. The only layer of security appears to be obscurity.

Improve this answer
  • 3
    Really? Can you prove it by downloading the Original (2400x1600) size version of this image? I suspect you haven't quite read the question properly. – Mark Whitaker Aug 26 '14 at 13:11
-3

Here's the easy way to do this (using Safari) without all the jargon you folks are throwing out there. Go to the all images page. Once you've enabled your Develop drop down menu go to Show Web Inspector. On the left side of the developer window, look for the images drop down. Click that and look for the string with the long number. When you click that, the image will appear in the developer window. On the far right you will see the image URL. Copy and paste the URL in a new browser window and the image appears and can be downloaded from there. OR just drag the image from the developer window. (It will likely have its name changed to Unknown.

Screen Shot of my methodology

Improve this answer
  • 3
    You've either misread the question or misunderstood the issue. I stated clearly "I'm well aware that once an image has appeared in their browser, a determined user can easily download it". You've only downloaded the Large size, not the Original. Try reading the question again and I'm sure you'll see what I was asking. Unfortunately for you the "jargon" is there for a reason! – Mark Whitaker Jul 31 '14 at 9:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.