Facebook's approach to images seems broken security-wise all around. You can also get to non-public images if you know the URL of the jpg--- linking to the image page won't work, but a direct link to the JPG will happily serve itself up.
This is notoriously hard problem to solve if you still want a traditional web server serving out static assets (which is the fastest way to do so). The only way I've seen to serve static content in an authenticated fashion is to serve it out of the application itself using the appropriate headers. I'm curious how others have solved this though...
The nginx team added another feature that's even more efficient for this recently (doesn't require a dynamic piece of code execution for each hit) - a module that creates "secure links" for protecting static resources:
(I think this feature would be a lot more useful if you could create links that expire after a certain amount of time).
Amazon S3 has a similar feature, which they call "query string authentication": http://docs.amazonwebservices.com/AmazonS3/latest/dev/index.... - again, you can generate a link to a static resource which is signed with your secret key and will only work for a specific amount of time. Last I saw, that's how Basecamp deals with download links for private files.
The cookie slows down the things a bit. I've never had such problem but what about complete randomization of static URLs, so they are not easily findable?
If the leaks are the issue, one might want to change the names, or just filesystem symlinks, periodically.
I've said it before, but I'd advise people change the email addresses they've attached to facebook. And definitely don't use the email address you give out to employers.
That's a pretty clever trick. I heard from some people that after doing the bulk upload thing, if your account in any way promotes a business, it gets shutdown after about a week. Anyone who uploads large contact lists to facebook gets into some type of human review system.
I don't see how this is a 'security hole'. You're still going to be subject to the user's security restrictions when you go to their profile. You won't get anymore information than you would if you had searched their name and opened their profile legitimately.
13 comments
[ 1.6 ms ] story [ 36.8 ms ] threadhttp://kovyrin.net/2006/11/01/nginx-x-accel-redirect-php-rai...
The nginx team added another feature that's even more efficient for this recently (doesn't require a dynamic piece of code execution for each hit) - a module that creates "secure links" for protecting static resources:
http://wiki.nginx.org/NginxHttpSecureLinkModule
(I think this feature would be a lot more useful if you could create links that expire after a certain amount of time).
Amazon S3 has a similar feature, which they call "query string authentication": http://docs.amazonwebservices.com/AmazonS3/latest/dev/index.... - again, you can generate a link to a static resource which is signed with your secret key and will only work for a specific amount of time. Last I saw, that's how Basecamp deals with download links for private files.
If the leaks are the issue, one might want to change the names, or just filesystem symlinks, periodically.