Sounds like security by obscurity to me, which in my book is bad.
On their way through the web (unencrypted, mind you), the urls are visible to anyone. Any proxy server can start farming image urls. And what happens if someone reverse-engineers the number generation algorithm?
This is industry practice because it's cheap and the risk for exploitation is low. That doesn't mean it's secure or good. The OP is not missing a point.
If you can "reverse-engineer" (you mean "break") any common cryptographically secure random generator --- such as is provided by every mainstream operating system on the planet --- you can do far worse things than see Facebook photos. CSPRNGs are the font from which all real crypto keys spring. Viable attacks on RNGs are devastating to real cryptosystems. So relying on a CSPRNG isn't going out on a limb.
As for the rest of it: if you can capture the ID, you can capture the photo. See other comments on this thread for why that is and why it matters.
It's not really "security by obscurity", because the security mechanism is known to all. There's an authentication token that controls access to the image.
There are only two unusual factors. The token is contained in the URL instead of a cookie (which actually reduces the obscurity, but has no other effect). Also, the token is per-resource as opposed to per-user (which has both advantages and disadvantages).
As they say, you can't un-ring a bell. Once someone has seen a file, it could be in their browser cache, they could have saved it, and they might just remember its contents.
This no more prohibits revocation than right-click traps do. It was impossible to stop to begin with.
(Of course, I think you understand this, as you mentioned the browser cache. I'm mentioning this mostly for the benefit of later readers)
On their way through the web the images themselves are visible to "anyone" (any nodes or shared ethernets the packets go through), so if your photos are incriminating you should find a host you're willing to trust that will serve them https-only, or host them yourself.
Those of us having grown up bringing film to the drugstore aren't too concerned about URLs in our ISP's proxy server logs. Nobody cares about your facebook photos enough to risk their job at the ISP to steal them.
Comments
Sounds like security by obscurity to me, which in my book is bad.
On their way through the web (unencrypted, mind you), the urls are visible to anyone. Any proxy server can start farming image urls. And what happens if someone reverse-engineers the number generation algorithm?
This is industry practice because it's cheap and the risk for exploitation is low. That doesn't mean it's secure or good. The OP is not missing a point.
If you can "reverse-engineer" (you mean "break") any common cryptographically secure random generator --- such as is provided by every mainstream operating system on the planet --- you can do far worse things than see Facebook photos. CSPRNGs are the font from which all real crypto keys spring. Viable attacks on RNGs are devastating to real cryptosystems. So relying on a CSPRNG isn't going out on a limb.
As for the rest of it: if you can capture the ID, you can capture the photo. See other comments on this thread for why that is and why it matters.
It's not really "security by obscurity", because the security mechanism is known to all. There's an authentication token that controls access to the image.
There are only two unusual factors. The token is contained in the URL instead of a cookie (which actually reduces the obscurity, but has no other effect). Also, the token is per-resource as opposed to per-user (which has both advantages and disadvantages).
It does have the important disadvantage that you can not revoke access to anything. If someone has seen it once, they can see it again.
On the other hand, who cares... it's also in their browser cache
As they say, you can't un-ring a bell. Once someone has seen a file, it could be in their browser cache, they could have saved it, and they might just remember its contents.
This no more prohibits revocation than right-click traps do. It was impossible to stop to begin with.
(Of course, I think you understand this, as you mentioned the browser cache. I'm mentioning this mostly for the benefit of later readers)
On their way through the web the images themselves are visible to "anyone" (any nodes or shared ethernets the packets go through), so if your photos are incriminating you should find a host you're willing to trust that will serve them https-only, or host them yourself.
Those of us having grown up bringing film to the drugstore aren't too concerned about URLs in our ISP's proxy server logs. Nobody cares about your facebook photos enough to risk their job at the ISP to steal them.