Big changes to SmugMug's privacy and security released

[Baldy]

What:

1. SmugMug gallery URLs are now appended with an underscore and 5 alpha-numeric characters, and so are image URLs. We call them keys. URLs with both gallery and image numbers will have two keys. Occasionally, you'll see an URL with three keys.

2. Where we used to call galleries private, we now call them unlisted.

3. When you create a gallery, we used to offer two options: public and private. Now we offer three: public, unlisted, and lock it down.

Lock it down means we ask you to set a password, we make it unlisted, we turn off external links, and we turn right-click protection on in the case of pros.

Why:

1. The keys are to make it much harder (but not impossible) to find unlisted galleries and photos via guessing URLs.

2. The word unlisted was chosen because the word private meant different things to different people.

Unlisted means that it doesn't appear to your visitors unless they're logged in as you. If you give the link to someone, however, they can get right in without a password. It's like an unlisted phone in the U.S. If you give it out, people can call it.

Gotchas:

1. Galleries and images uploaded before this change are grandfathered. That means the olde links to them still work, so posts in forums and blogs will work as always.

It also means they are as easy to guess as they were before this change. It seems that most of our customers are not concerned about this but some are very concerned, and hence the change.

2. If you are concerned, you can place a password on your grandfathered galleries and turn external links off. Or you can move your photos to new, unlisted galleries. If you set a password, your old links to forums and blogs will continue to work as long as you don't turn external links off. If you move them to new galleries, the old links will break. We're really sorry to say that. If you move them back to grandfathered galleries, they will work again.

3. Grandfathered galleries and images will look to you like they have keys now, so any new links you make will contain those keys. If you move a grandfathered image to a new gallery some time in the future after posting a link with its keys, it won't break.

Clear as mud?! Here are some discussions that led to these changes. Many thanks to everyone who chimed in, and we're sorry for some of the compromises we felt we had to make for the sake of scalability or whatever.

Questions?

Bugs? We're standing by and holding our breath!

[jogle]

Originally Posted by Baldy

What:
2. If you are concerned, you can place a password on your grandfathered galleries and turn external links off. Or you can move your photos to new, unlisted galleries. If you set a password, your old links to forums and blogs will continue to work as long as you don't turn external links off. If you move them to new galleries, the old links will break. We're really sorry to say that. If you move them back to grandfathered galleries, they will work again.

Thanks for moving so quickly, I realize this kind of change is a huge headache.

After some testing over a few days I would be happy to move all my galleries to the new keyed setup. Are you planning a tool, like for smugmungus, where you can update all the galleries or maybe even my whole site in one step?

[denisegoldberg]

Thank you for not breaking my existing links to my photos and galleries - that was very very very important to me.

--- Denise

[devbobo]

Originally Posted by jogle

Thanks for moving so quickly, I realize this kind of change is a huge headache.

After some testing over a few days I would be happy to move all my galleries to the new keyed setup. Are you planning a tool, like for smugmungus, where you can update all the galleries or maybe even my whole site in one step?

I doubt that is going to happen at this stage, but since you are familiar with the api...I am sure that you could easily write something that would address this

[digitalpins]

thanks for this and thank you for keeping our old links the way they are... wow that was fast just a week ago this was talked about.

Awesome job smugmug

[JenGrace]

I created a test gallery for a moment. At the creation point, I was offered the three options. But when I hit customize gallery, I only got public and unlisted. So the only chance to put a gallery on 'lockdown' is when I create it, correct?

[devbobo]

Originally Posted by JenW

I created a test gallery for a moment. At the creation point, I was offered the three options. But when I hit customize gallery, I only got public and unlisted. So the only chance to put a gallery on 'lockdown' is when I create it, correct?

Jen,

I believe that the 'Lock it down' option is a shortcut for setting a gallery password, and the SmugIslands and External Links settings to no. Plus sets Protected to YES for pro accounts.

Cheers,

David

[rainforest1155]

Originally Posted by JenW

I created a test gallery for a moment. At the creation point, I was offered the three options. But when I hit customize gallery, I only got public and unlisted. So the only chance to put a gallery on 'lockdown' is when I create it, correct?

Jen, this is a valid question. Lockdown basically just sets a gallery to unlisted, adds a password, sets SmugIsland settings to no and disables external links. If you're a Pro, protection will be enabled as well. You were all ready able to set all of these settings prior, but we didn't have this one-click setting to engage all these locks at once.

Sebastian

[Andy]

Originally Posted by JenW

I created a test gallery for a moment. At the creation point, I was offered the three options. But when I hit customize gallery, I only got public and unlisted. So the only chance to put a gallery on 'lockdown' is when I create it, correct?

On the create page, we make the lockdown button just for a quick convenience - for new customers and for any customer that hasn't set a gallery quicksetting.

On the gallery customize page, ALL the options are available to you, on an individual gallery basis, or, if you use a quick setttings template, you can apply it to all your new galleries as you make 'em :)

http://www.smugmug.com/help/picture-storage

Holler if you need more help :) Thanks!

[JenGrace]

Dur! Silly me... I just realised that upon rereading baldy's IP. Chalk that one up to posting less than an hour after waking up.