In the Flickr privacy settings page there's a setting entitled "Who can access your original image files?". If I set this to anything other than "Anyone" (e.g. "Only you" or "Your contacts"), is it still possible for an unauthorised user to access the original image without someone giving them the URL for it? (Assume that my original photo is larger than 1024px, so there's an Original version distinct from the Large version. Also assume it's not Creative Commons licensed.)
I'm well aware that once an image has appeared in their browser, a determined user can easily download it regardless of any disincentives (e.g. JavaScript blockers) the browser tries to put in their way. However, I believe the following are correct:
An unauthorised user will just see an error page if they try to view the Original Size page on Flickr (e.g. this page).
Although the URL of that page is easily guessable (just add
sizes/o/
to the end of the regular photo page URL), the URL of the actual original image file has a random component and cannot easily be guessed.
There are plenty of people on Flickr and elsewhere saying the disable download setting is useless, but I haven't seen any proof. Does anyone know for certain that it can be bypassed? If you say yes, I'll expect you to prove it by sending me the original size of my latest image! (It's meant to be available to friends & family only - so not you, Uncle Goober...)
Some context: I should point out I'm not looking to steal photos, I'm trying to understand how safe mine are, specifically with regard to this geofences loophole that was reported today.