Every photo in Facebook is accessible if you know the its secret photo ID, which is an unguessably large random number.
It's not completely optimal that Facebook embeds secrets in URLs this way (for example, if you browse directly to a photo via its fbcdn URL, you'll have planted the secret in your browser history). But it's a common industry practice, and since it's used on URLs that shouldn't normally end up in your browser history, it's hard to see the major problem with it.
So yes, you're missing a major point, and you haven't found a big privacy leak. Sorry.
Sounds like security by obscurity to me, which in my book is bad.
On their way through the web (unencrypted, mind you), the urls are visible to anyone. Any proxy server can start farming image urls. And what happens if someone reverse-engineers the number generation algorithm?
This is industry practice because it's cheap and the risk for exploitation is low. That doesn't mean it's secure or good. The OP is not missing a point.
If you can "reverse-engineer" (you mean "break") any common cryptographically secure random generator --- such as is provided by every mainstream operating system on the planet --- you can do far worse things than see Facebook photos. CSPRNGs are the font from which all real crypto keys spring. Viable attacks on RNGs are devastating to real cryptosystems. So relying on a CSPRNG isn't going out on a limb.
As for the rest of it: if you can capture the ID, you can capture the photo. See other comments on this thread for why that is and why it matters.
It's not really "security by obscurity", because the security mechanism is known to all. There's an authentication token that controls access to the image.
There are only two unusual factors. The token is contained in the URL instead of a cookie (which actually reduces the obscurity, but has no other effect). Also, the token is per-resource as opposed to per-user (which has both advantages and disadvantages).
As they say, you can't un-ring a bell. Once someone has seen a file, it could be in their browser cache, they could have saved it, and they might just remember its contents.
This no more prohibits revocation than right-click traps do. It was impossible to stop to begin with.
(Of course, I think you understand this, as you mentioned the browser cache. I'm mentioning this mostly for the benefit of later readers)
On their way through the web the images themselves are visible to "anyone" (any nodes or shared ethernets the packets go through), so if your photos are incriminating you should find a host you're willing to trust that will serve them https-only, or host them yourself.
Those of us having grown up bringing film to the drugstore aren't too concerned about URLs in our ISP's proxy server logs. Nobody cares about your facebook photos enough to risk their job at the ISP to steal them.
This is presumably happening because people are deliberately taking images people gave them access to and embedding them on web pages Google is indexing.
The difference between this and "People of Facebook", the site where you can upload images your friends show you on Facebook, is that Facebook can detect, track, and disable these images, but can't do anything technical about images uploaded to "People of Facebook".
It is just silly to suggest that Facebook should take steps to prevent your friends from copying images. Nothing they do will work, and anything they do will create a false expectation of privacy on behalf of their users.
I found something interesting, there are four options in facebook for sharing photos 1. everyone ( of course on facebook I thought) 2. friends ( of course on facebook) 3. friends of friends ( again of course on facebook) 4. only me ( :) ) . So I don't find reason for giving access to anyone not having a facebook account and hence taking off control of the content.
You are stuck on this notion of publishing the link being "taking control of the content in ways the publisher didn't want" because you feel like you found this FBCDN link thing and it's captured your attention.
But in fact you lost control of the content the moment you published it to your friends (or whomever) on Facebook. We're just talking about 2 numbers, one 136 bits long and the other 73,720 bits long. I don't think the difference between these two numbers is worth arguing about.
Nice find. This is why it's 'not optimal' as Thomas puts it. Does anyone want to test what happens at different privacy settings? Sorry, I don't really use facebook.
Click on any of those images and the sidebar will tell you what web site Google found it on. This isn't a Facebook security hole. It's people publishing photos on the public web.
Which, ironically, makes me more confident in this implementation, because someone deliberately made them harder to guess; a lot of times, things look random and long but really aren't.
But couldn't a better checkpoint be designed with some overhead?
Say all urls containing /static/.. don't refer to an actual physical resource but go to a controller which checks the access and then serves the file. As such, the URL if given to someone else will fail as the controller won't authorize the file transfer.
I understand this isn't a big privacy leak. It looked awkward to me at first instance. I am trying to find what the general industry practice is in this and what could be the ideal solution as we are trying to build some image hosting for our product. Your answer is very insightful indeed.
I typically appreciate tptacek's security remarks, and agree that once you trust someone to view a photo, you're trusting them to not repost it.
However, I disagree that "everyone is doing it this way" is a good reason to do it this way.
Flickr, as I noted separately in this thread, doesn't do it this way. Changing privacy settings changes the URL, so someone using the URL (a common use case for images) can't use it any more. That's the "user expected" behavior. Facebook's behavior is a generally unwelcome surprise.
Additionally, since you're considering building image hosting: "token protected" URLs are well understood and often applied as a best effort solution to this problem. A token protected URL typically has an expiry, and in typical use is only valid briefly when issued for the visitor requesting the (authenticated) page containing embedded photos.
Of course, the CDN edge cache servers have to cache the object yet respect the tokens, which requires a bit more intelligence from the cache, which is why "general industry practice" is to take the easier shortcut of not protecting the URL and image object at all.
Disclaimer: We offer token protected video and image CDN delivery, calling it "deep link protection". Our DLP, and token schemes in general, protect the link from misuse, not the asset.
That link isn't about S3. That link is about CloudFront, the CDN edge caching layer above S3. S3 storage has always offered token protected links. CloudFront CDN introduced protected links only recently.
Customers and clients of CloudFront CDN (which uses S3 storage as its origin) wanted protected URLs, and AWS went to the time and expense to provide them. Content owners large enough to want or need CloudFront edge caching believe there are legitimate business cases for single use, expiring, IP restricted, or other classes of protected URLs for content.
As for Facebook:
Facebook operates web servers generating authenticated and authorized web pages. These pages are dynamic, generated per user, based on current privacy settings. These privacy-managed pages contain links to assets considered, by users, to be just as private as the page.
When the user changes privacy settings for the page, the linked assets privacy could easily be kept in line, as demonstrated by CloudFront CDN being able to support private content links.
Facebook's fault is that the privacy managed page links to public (non-privacy managed) assets, using links that do not respect the containing page's privacy settings.
To say the image shouldn't have privacy settings is to say the page shouldn't have privacy settings "because anyone could save it and repost it". (Which people do, via screenshots.) That's expected and accepted.
But once they change their privacy settings, users believe access permission changes. Access permission does change for the container page, but not the linked assets. That's a broken model.
Presumably it means that anyone you show a photo to intentionally can in turn show it to people you don't intend to see the photo. Which, of course, must be true, no matter what Facebook does to protect photos.
Yes, but in addition they also assume that:
- That the only way you know the photo ID is by having access to the photo.
- If you had access to the photo at some point, you have access to it forever (even if it is revoked later on).
It may be industry wide practice as you have noted but the bottom line is that the privacy settings are not explicitly checked on every photo access. Makes you wonder where else they are using similar logic.
Not to lighten the issue, I think this is a security flaw, but the same is true if they simply save it to their computer. You have to trust your audience to begin with or you're hosed. There's no real way of stopping them from copying or disseminating content.
The authorization happens at the time you request the photo url, not the photo itself. So the security is on finding out what the url is, not the actual photo request. It'd be the same as someone being able to login if they know your password. That URL is the password.
Can someone explain to me what on Earth is going on in this comment thread? This response doesn't make any sense. Obviously, if you share your photo with someone, they can publish your photo! Welcome to the world of digital media! Why is this modded up, and the grandparent modded down? (Edit: It's more sane now, when I posted this the above was at 7 and tptacek was at -1.)
instead of the karma, I am more interested in people believing that this is actually an issue, come on. I understand the complications in making things the way they should be, but then right behaviour is the right behaviour.
Leaking photos by publishing fbcdn links is worse for attackers on every axis than simply stealing and reposting the photo:
* The leaker and the viewers are more traceable, since they're hitting Facebook's servers
* Facebook can cut off access to the photos by reassigning the IDs
* To get the actual link, you have to dig into the Facebook page source; to get the photo, you just have to right-click on it.
This is a stupid, silly threat to worry about. Unless you find a way to predict fbcdn URLs, there's nothing overtly wrong with what Facebook is doing. Plenty of sites rely on the same technique to protect significantly more sensitive information.
You're talking about a leak while the photo is actively posted. I think that's obvious to users. It's less obvious that users can change privacy settings or delete the photo, and yet it's still accessible.
The interface says access is now (going forward) changed, but access doesn't change.
What's overtly wrong with what Facebook is doing shows up in practice in the news every time someone becomes an unexpected celebrity. The person promptly and maybe even preemptively changes their privacy settings, but their images remain available.
I don't understand what you're trying to say. It sounds like you're saying, "sure, there's a totally obvious and simple way that people on Facebook can take and republish your pictures that Facebook can't do anything about, but did you also know that there's also this really convoluted way they could also do that, and Facebook could fix that?"
If you publish images to the public on Facebook, all bets are simply off. It is a bad idea for Facebook to give people the mistaken idea that any settings change on Facebook could ever take back anything posted to "Everyone" on the site.
Not talking about "Everyone". Talking about, for example, your best friend. Then you turn out to be a Russian spy named Anna. Suddenly your friend, who didn't care to download your photos before, now does want to download them.
More to the point, talking about changing privacy settings, and having the change work, where work is not defined as "defeat tptacek" but "defeat casual users".
The logical conclusion to "It is a bad idea for Facebook to give people the mistaken idea that any settings change on Facebook could ever take back anything" is for Facebook to remove any ability to set privacy more restrictive, ever. I doubt that would be popular.
While "you can't take it back" may be technically correct, most photos aren't being downloaded to repost, merely viewed inline online. There's no reason a user changing privacy to be more restrictive shouldn't expect that change to apply going forward.
Comments
No, they aren't.
Every photo in Facebook is accessible if you know the its secret photo ID, which is an unguessably large random number.
It's not completely optimal that Facebook embeds secrets in URLs this way (for example, if you browse directly to a photo via its fbcdn URL, you'll have planted the secret in your browser history). But it's a common industry practice, and since it's used on URLs that shouldn't normally end up in your browser history, it's hard to see the major problem with it.
So yes, you're missing a major point, and you haven't found a big privacy leak. Sorry.
Sounds like security by obscurity to me, which in my book is bad.
On their way through the web (unencrypted, mind you), the urls are visible to anyone. Any proxy server can start farming image urls. And what happens if someone reverse-engineers the number generation algorithm?
This is industry practice because it's cheap and the risk for exploitation is low. That doesn't mean it's secure or good. The OP is not missing a point.
If you can "reverse-engineer" (you mean "break") any common cryptographically secure random generator --- such as is provided by every mainstream operating system on the planet --- you can do far worse things than see Facebook photos. CSPRNGs are the font from which all real crypto keys spring. Viable attacks on RNGs are devastating to real cryptosystems. So relying on a CSPRNG isn't going out on a limb.
As for the rest of it: if you can capture the ID, you can capture the photo. See other comments on this thread for why that is and why it matters.
It's not really "security by obscurity", because the security mechanism is known to all. There's an authentication token that controls access to the image.
There are only two unusual factors. The token is contained in the URL instead of a cookie (which actually reduces the obscurity, but has no other effect). Also, the token is per-resource as opposed to per-user (which has both advantages and disadvantages).
It does have the important disadvantage that you can not revoke access to anything. If someone has seen it once, they can see it again.
On the other hand, who cares... it's also in their browser cache
As they say, you can't un-ring a bell. Once someone has seen a file, it could be in their browser cache, they could have saved it, and they might just remember its contents.
This no more prohibits revocation than right-click traps do. It was impossible to stop to begin with.
(Of course, I think you understand this, as you mentioned the browser cache. I'm mentioning this mostly for the benefit of later readers)
On their way through the web the images themselves are visible to "anyone" (any nodes or shared ethernets the packets go through), so if your photos are incriminating you should find a host you're willing to trust that will serve them https-only, or host them yourself.
Those of us having grown up bringing film to the drugstore aren't too concerned about URLs in our ISP's proxy server logs. Nobody cares about your facebook photos enough to risk their job at the ISP to steal them.
A quick google image search to the domain http://sphotos.ak.fbcdn.net/photos-ak-snc1/v2010 gives me a large number of images hosted there http://bit.ly/9Lp3r5 . This isn't the behaviour I would like.
This is presumably happening because people are deliberately taking images people gave them access to and embedding them on web pages Google is indexing.
The difference between this and "People of Facebook", the site where you can upload images your friends show you on Facebook, is that Facebook can detect, track, and disable these images, but can't do anything technical about images uploaded to "People of Facebook".
It is just silly to suggest that Facebook should take steps to prevent your friends from copying images. Nothing they do will work, and anything they do will create a false expectation of privacy on behalf of their users.
I found something interesting, there are four options in facebook for sharing photos 1. everyone ( of course on facebook I thought) 2. friends ( of course on facebook) 3. friends of friends ( again of course on facebook) 4. only me ( :) ) . So I don't find reason for giving access to anyone not having a facebook account and hence taking off control of the content.
You are stuck on this notion of publishing the link being "taking control of the content in ways the publisher didn't want" because you feel like you found this FBCDN link thing and it's captured your attention.
But in fact you lost control of the content the moment you published it to your friends (or whomever) on Facebook. We're just talking about 2 numbers, one 136 bits long and the other 73,720 bits long. I don't think the difference between these two numbers is worth arguing about.
Nice find. This is why it's 'not optimal' as Thomas puts it. Does anyone want to test what happens at different privacy settings? Sorry, I don't really use facebook.
Click on any of those images and the sidebar will tell you what web site Google found it on. This isn't a Facebook security hole. It's people publishing photos on the public web.
FWIW, the random number wasn't always large enough to be unguessable:
http://news.ycombinator.com/item?id=490788
Which, ironically, makes me more confident in this implementation, because someone deliberately made them harder to guess; a lot of times, things look random and long but really aren't.
But couldn't a better checkpoint be designed with some overhead?
Say all urls containing /static/.. don't refer to an actual physical resource but go to a controller which checks the access and then serves the file. As such, the URL if given to someone else will fail as the controller won't authorize the file transfer.
I did it once with nginx at the front and django at the backend using X-Sendfile. I don't have the code around but it was similar to what is proposed in this discussion: http://groups.google.com/group/django-users/browse_thread/th...
Of course, this can't be done for the CDNs.
When you say it's a common industry practice, is the practice there because of CDNs?
I understand this isn't a big privacy leak. It looked awkward to me at first instance. I am trying to find what the general industry practice is in this and what could be the ideal solution as we are trying to build some image hosting for our product. Your answer is very insightful indeed.
I typically appreciate tptacek's security remarks, and agree that once you trust someone to view a photo, you're trusting them to not repost it.
However, I disagree that "everyone is doing it this way" is a good reason to do it this way.
Flickr, as I noted separately in this thread, doesn't do it this way. Changing privacy settings changes the URL, so someone using the URL (a common use case for images) can't use it any more. That's the "user expected" behavior. Facebook's behavior is a generally unwelcome surprise.
Additionally, since you're considering building image hosting: "token protected" URLs are well understood and often applied as a best effort solution to this problem. A token protected URL typically has an expiry, and in typical use is only valid briefly when issued for the visitor requesting the (authenticated) page containing embedded photos.
See: http://aws.typepad.com/aws/2009/11/new-amazon-cloudfront-fea...
Of course, the CDN edge cache servers have to cache the object yet respect the tokens, which requires a bit more intelligence from the cache, which is why "general industry practice" is to take the easier shortcut of not protecting the URL and image object at all.
Disclaimer: We offer token protected video and image CDN delivery, calling it "deep link protection". Our DLP, and token schemes in general, protect the link from misuse, not the asset.
Do people generally serve content directly out of S3 to the public? That costs money. We don't; we use S3 as a cache, and to serve files to customers.
Point being, S3 solves a different problem than Facebook does.
That link isn't about S3. That link is about CloudFront, the CDN edge caching layer above S3. S3 storage has always offered token protected links. CloudFront CDN introduced protected links only recently.
Customers and clients of CloudFront CDN (which uses S3 storage as its origin) wanted protected URLs, and AWS went to the time and expense to provide them. Content owners large enough to want or need CloudFront edge caching believe there are legitimate business cases for single use, expiring, IP restricted, or other classes of protected URLs for content.
As for Facebook:
Facebook operates web servers generating authenticated and authorized web pages. These pages are dynamic, generated per user, based on current privacy settings. These privacy-managed pages contain links to assets considered, by users, to be just as private as the page.
When the user changes privacy settings for the page, the linked assets privacy could easily be kept in line, as demonstrated by CloudFront CDN being able to support private content links.
Facebook's fault is that the privacy managed page links to public (non-privacy managed) assets, using links that do not respect the containing page's privacy settings.
To say the image shouldn't have privacy settings is to say the page shouldn't have privacy settings "because anyone could save it and repost it". (Which people do, via screenshots.) That's expected and accepted.
But once they change their privacy settings, users believe access permission changes. Access permission does change for the container page, but not the linked assets. That's a broken model.
Now that you know the answer, maybe you should edit your HN post so that it isn't broadcasting "Facebook is insecure" on the HN RSS feed.
done. :)
Facebook allows very sophisticated privacy settings, including allowing access to photos for a specific subset of users only.
I wonder what those privacy settings mean then, if the authorization checks are not happenning when the photo is accessed?
Presumably it means that anyone you show a photo to intentionally can in turn show it to people you don't intend to see the photo. Which, of course, must be true, no matter what Facebook does to protect photos.
Yes, but in addition they also assume that: - That the only way you know the photo ID is by having access to the photo. - If you had access to the photo at some point, you have access to it forever (even if it is revoked later on).
It may be industry wide practice as you have noted but the bottom line is that the privacy settings are not explicitly checked on every photo access. Makes you wonder where else they are using similar logic.
Not to lighten the issue, I think this is a security flaw, but the same is true if they simply save it to their computer. You have to trust your audience to begin with or you're hosed. There's no real way of stopping them from copying or disseminating content.
The authorization happens at the time you request the photo url, not the photo itself. So the security is on finding out what the url is, not the actual photo request. It'd be the same as someone being able to login if they know your password. That URL is the password.
A secret Id that every user you have shared the photo with knows and hence can publish them ? Uh.
Can someone explain to me what on Earth is going on in this comment thread? This response doesn't make any sense. Obviously, if you share your photo with someone, they can publish your photo! Welcome to the world of digital media! Why is this modded up, and the grandparent modded down? (Edit: It's more sane now, when I posted this the above was at 7 and tptacek was at -1.)
Someone needs to invent something to fix this problem. Some type of "rights management" tool.
instead of the karma, I am more interested in people believing that this is actually an issue, come on. I understand the complications in making things the way they should be, but then right behaviour is the right behaviour.
The photograph itself is just a larger and less random number that can also be published.
Your "friend" can download the photo and publish it somewhere else, open for everyone.
why, if you can simply hotlink to facebook cdn?
Leaking photos by publishing fbcdn links is worse for attackers on every axis than simply stealing and reposting the photo:
* The leaker and the viewers are more traceable, since they're hitting Facebook's servers
* Facebook can cut off access to the photos by reassigning the IDs
* To get the actual link, you have to dig into the Facebook page source; to get the photo, you just have to right-click on it.
This is a stupid, silly threat to worry about. Unless you find a way to predict fbcdn URLs, there's nothing overtly wrong with what Facebook is doing. Plenty of sites rely on the same technique to protect significantly more sensitive information.
You're talking about a leak while the photo is actively posted. I think that's obvious to users. It's less obvious that users can change privacy settings or delete the photo, and yet it's still accessible.
The interface says access is now (going forward) changed, but access doesn't change.
What's overtly wrong with what Facebook is doing shows up in practice in the news every time someone becomes an unexpected celebrity. The person promptly and maybe even preemptively changes their privacy settings, but their images remain available.
http://news.bbc.co.uk/2/hi/8060407.stm
Even if it's technically reasonable, it's not user expected behavior.
I don't understand what you're trying to say. It sounds like you're saying, "sure, there's a totally obvious and simple way that people on Facebook can take and republish your pictures that Facebook can't do anything about, but did you also know that there's also this really convoluted way they could also do that, and Facebook could fix that?"
If you publish images to the public on Facebook, all bets are simply off. It is a bad idea for Facebook to give people the mistaken idea that any settings change on Facebook could ever take back anything posted to "Everyone" on the site.
Not talking about "Everyone". Talking about, for example, your best friend. Then you turn out to be a Russian spy named Anna. Suddenly your friend, who didn't care to download your photos before, now does want to download them.
More to the point, talking about changing privacy settings, and having the change work, where work is not defined as "defeat tptacek" but "defeat casual users".
The logical conclusion to "It is a bad idea for Facebook to give people the mistaken idea that any settings change on Facebook could ever take back anything" is for Facebook to remove any ability to set privacy more restrictive, ever. I doubt that would be popular.
While "you can't take it back" may be technically correct, most photos aren't being downloaded to repost, merely viewed inline online. There's no reason a user changing privacy to be more restrictive shouldn't expect that change to apply going forward.