Privacy on Smugmug

Thronsen

I originally chose Smugmug because among other reasons it had the best reputation for privacy and respect of the images uploaded. I was disgusted by places like Facebook's apparent 'ownership' of uploaded photos.

Recently the people I upload photos for have asked for additional information. I was hoping that someone could point me in the right direction to find information to answer their security concerns.

- How is Smugmug more secure then places like facebook in terms of ownership of your photos?

- Any information about how Smugmug is secure from the wilds of the internet, beyond of course User Error. I know the basics of securing a gallery.

If you could point me in the right direction that would be great. Im not a lawyer, so plain language is fantastic.

Thanks,

jfriend

Here is Smugmug's terms of service: http://www.smugmug.com/aboutus/terms/. You may be particularly interested in paragraph 13, starting with the 2nd paragraph after point h.

I am not from Smugmug or a lawyer either (see a lawyer if you need to), but my interpretation of that section is that you are granting Smugmug the right to display your photos in connection with the site, but you retain copyright and ownership of them.

I'm not sure what you mean by "secure from the wilds of the internet". Password protected galleries or sites are not accessible without first supplying the password so they are as secure as you make the password. Public galleries are open to the entire internet. Watermarks can be used to help protect public images against undesired theft or usage.

Andy

Hi. As John said, I redid our terms a while back to explicitly and plainly state that your photos are yours and we want and have no ownership of them.

As to image protection, block larger sizes, right click protect, and use a watermark. You can also block external linking, if you wish.

Thronsen

Andy wrote: »

Hi. As John said, I redid our terms a while back to explicitly and plainly state that your photos are yours and we want and have no ownership of them.

As to image protection, block larger sizes, right click protect, and use a watermark. You can also block external linking, if you wish.

Hi there-

Thanks for your replies. Is that what you were referring to:

'You retain the copyright in any User Content you post on the Site. SmugMug neither has nor wants any ownership of your Content. However, by uploading and/or posting any User Content to the Site, you grant SmugMug a perpetual, nonexclusive and royalty-free right to use the User Content and the name that is submitted in connection with such User Content, as is reasonably necessary to display the User Content, provide the Services and to facilitate, at Content Owner's direction, the license of Photos or the sale of Products on the Site. '

Is there anything else I should be aware of?

For the second part, I am aware of the features to protect my gallery. I was more looking for the sort of 'What happens if someone spams passwords at my gallery' or 'what if a hacker attacks smugmug'. Presuming of course that 'hackers' were interested in spending their time getting photos and not credit card numbers.

gecko0

Thronsen wrote: »

Hi there-

Thanks for your replies. Is that what you were referring to:

'You retain the copyright in any User Content you post on the Site. SmugMug neither has nor wants any ownership of your Content. However, by uploading and/or posting any User Content to the Site, you grant SmugMug a perpetual, nonexclusive and royalty-free right to use the User Content and the name that is submitted in connection with such User Content, as is reasonably necessary to display the User Content, provide the Services and to facilitate, at Content Owner's direction, the license of Photos or the sale of Products on the Site. '

Is there anything else I should be aware of?

For the second part, I am aware of the features to protect my gallery. I was more looking for the sort of 'What happens if someone spams passwords at my gallery' or 'what if a hacker attacks smugmug'. Presuming of course that 'hackers' were interested in spending their time getting photos and not credit card numbers.

+1...I'd be interested in hearing the security model in place for brute force attacks on accounts, etc. Since SM stores a lot of financial data and actual $$ for us (from sales until paid out), I'm sure there are several layers of security there.

Andy- Is there an account lockout policy in place after X-number of failures, etc?

flyingpoint

Pci?
+2

Love to hear the practices / policies in this area. In particular, is Smugmug PCI compliant?

Andy

flyingpoint wrote: »

In particular, is Smugmug PCI compliant?

Yup, completely and fully. Our card companies, authorization provider and banks wouldn't allow us to accept cards if we were not.

Thronsen

Thronsen wrote: »

Hi there-

Thanks for your replies. Is that what you were referring to:

'You retain the copyright in any User Content you post on the Site. SmugMug neither has nor wants any ownership of your Content. However, by uploading and/or posting any User Content to the Site, you grant SmugMug a perpetual, nonexclusive and royalty-free right to use the User Content and the name that is submitted in connection with such User Content, as is reasonably necessary to display the User Content, provide the Services and to facilitate, at Content Owner's direction, the license of Photos or the sale of Products on the Site. '

Is there anything else I should be aware of?

For the second part, I am aware of the features to protect my gallery. I was more looking for the sort of 'What happens if someone spams passwords at my gallery' or 'what if a hacker attacks smugmug'. Presuming of course that 'hackers' were interested in spending their time getting photos and not credit card numbers.

Hi there-

Any more information on the above?

Thanks.

Andy

Thronsen wrote: »

Hi there-

Any more information on the above?

Thanks.

Hi, Specifically, what is your question? Do you have a question about our terms? Thanks!

hackmann

Thronsen wrote: »

Hi there-

'You retain the copyright in any User Content you post on the Site. SmugMug neither has nor wants any ownership of your Content. However, by uploading and/or posting any User Content to the Site, you grant SmugMug a perpetual, nonexclusive and royalty-free right to use the User Content and the name that is submitted in connection with such User Content, as is reasonably necessary to display the User Content, provide the Services and to facilitate, at Content Owner's direction, the license of Photos or the sale of Products on the Site. '

There is nothing wrong with that. That means you just granted access to smugmug manage the content that you own the copyright, at your direction, to facilitate license or sales. You are the owner and smugmug is the tool you need to accomplish that.

Thronsen

Thronsen wrote: »

Hi there-

Thanks for your replies. Is that what you were referring to:

'You retain the copyright in any User Content you post on the Site. SmugMug neither has nor wants any ownership of your Content. However, by uploading and/or posting any User Content to the Site, you grant SmugMug a perpetual, nonexclusive and royalty-free right to use the User Content and the name that is submitted in connection with such User Content, as is reasonably necessary to display the User Content, provide the Services and to facilitate, at Content Owner's direction, the license of Photos or the sale of Products on the Site. '

Is there anything else I should be aware of?

For the second part, I am aware of the features to protect my gallery. I was more looking for the sort of 'What happens if someone spams passwords at my gallery' or 'what if a hacker attacks smugmug'. Presuming of course that 'hackers' were interested in spending their time getting photos and not credit card numbers.

Its this post that I was looking for an answer to.

Thanks.

Andy

Thronsen wrote: »

Its this post that I was looking for an answer to.

Thanks.

Our terms mean that your photos are yours - we want and have no financial or copyright interest in them. We only are allowed to display them on your site, to do what you ask us to do. And yes, we have mechanisms in place to prevent brute force attacks. Does that help?

Thronsen

Hi there-

Thanks for your reply, but still looking for more info.

In one of your previous replies you said:

'Hi. As John said, I redid our terms a while back to explicitly and plainly state that your photos are yours and we want and have no ownership of them'

I then listed what I thought you were referring to, but if there is something else I should be looking at, please let me know. Your terms and conditions are lengthy, and I was looking for some guidance.

Also, what measures do you have in place to defeat brute force attacks, as well as other security fixes for other issues?

I have to present this to an organization that is thinking of using Smugmug, so am trying to gather as much information as possible for the inevitable 'are the photos safe online with Smugmug' questions.

Thanks.

Andy

Thronsen wrote: »

Hi there-

Thanks for your reply, but still looking for more info.

In one of your previous replies you said:

'Hi. As John said, I redid our terms a while back to explicitly and plainly state that your photos are yours and we want and have no ownership of them'

I then listed what I thought you were referring to, but if there is something else I should be looking at, please let me know. Your terms and conditions are lengthy, and I was looking for some guidance.

No, what you posted in #8 above is exactly what I was referring to. Let me know if any part of that is unclear.

Also, what measures do you have in place to defeat brute force attacks, as well as other security fixes for other issues?

For security reasons, I'm not going to explain the measures and things we have in place, I'm very sorry. What 'other issues' are you referring to - I'm happy to explain further if you can guide me.

hackmann

So far, what i saw was a very fast response to costumers or glitches on the system. The last system bug I read about in this forum was fixed in less than 24 hours. They are fast...

Thronsen

Andy wrote: »

For security reasons, I'm not going to explain the measures and things we have in place, I'm very sorry. What 'other issues' are you referring to - I'm happy to explain further if you can guide me.

This is becoming a little frustrating. I would have thought this would be something you would be happy to trumpet, even have already posted on your site to entice new accounts. But 2 weeks later I have no real information on your security policies.

Im not looking for a detailed plan how to hack your site. Im just looking for something non-technical I can show non-technical people who are thinking of getting a Smugmug account and are concerned about the security of their photos when they are under your care.

Obviously I wouldnt want you to reveal anything that would jeopardize the sites security. But there should be some middle ground between that and the lack of information you are providing now.

Generic boilerplate is fine, but I need something to show people that you are as serious about security as I thought you were when I closed my facebook and picasa accounts and moved all my photos here.

Thanks.

Andy

Thronsen wrote: »

This is becoming a little frustrating. I would have thought this would be something you would be happy to trumpet, even have already posted on your site to entice new accounts. But 2 weeks later I have no real information on your security policies.

Im not looking for a detailed plan how to hack your site. Im just looking for something non-technical I can show non-technical people who are thinking of getting a Smugmug account and are concerned about the security of their photos when they are under your care.

Obviously I wouldnt want you to reveal anything that would jeopardize the sites security. But there should be some middle ground between that and the complete lack of information you are providing now.

Generic boilerplate is fine, but I need something to show people that you are as serious about security as I thought you were when I closed my facebook and picasa accounts and moved all my photos here.

Thanks.

Hi Thronsen, I'm sorry to frustrate you! I'm happy to help you in detail - write us at the help desk, http://smugmug.com/help ATTN: Andy and I'll try to put something together that will work for the folks you want to show it to, ok?

Thronsen

I just spammed my own account with around 20 false passwords. Didnt notice any security precautions. Obviously thats not exactly a big brute force, but someone typing the wrong password 20 times in a minute usually raises a red flag.

Im not saying you dont have precautions, or that you dont take it seriously. I just need information to show other people that you do.

Thronsen

Andy wrote: »

Hi Thronsen, I'm sorry to frustrate you! I'm happy to help you in detail - write us at the help desk, http://smugmug.com/help ATTN: Andy and I'll try to put something together that will work for the folks you want to show it to, ok?

Ok thanks alot.