Option to disable the iphone 'backdoor'?

stuartb · March 27, 2008

Having gone to the bother of hiding all my category names from my homepage using CSS it is mildly annoying that people can simply browse ALL my 'public' galleries by adding iphone to the url eg www.myname.smugmug.com/iphone

As a Power User I would like a way to 'opt out' of my galleries being offered up to iphone browsers in such an unfiltered way. I would like the same access control that I have via my 'normal' smugmug homepage (ie CSS)

I dont want to password all my galleries . . so please dont suggest that . . I am happy that my categories are more or less 'hidden' on my homepage using CSS, I would just like to disable the iphone 'back door'.

Some sort of 'add to iphone' option in Gallery Tools would be fine . . a bit like an 'IPhone Sharegroup', would give ME the choice as to what galleries are 'iphone visible'

Andy · March 27, 2008

Hello, this is not a "back door" since you have public galleries. Back door implies that there is a security hole, so your thread title is a bit misleading.

I'm just saying.

mbellot · March 27, 2008

Andy wrote:

Hello, this is not a "back door" since you have public galleries. Back door implies that there is a security hole, so your thread title is a bit misleading.

I'm just saying.

OK, then how about an option to simply disable the iphone link globally for a user account (like hello world)?

I tried to get around it with a vanity url, but no luck.

I'm in the same boat as Stuart, using one of the "hacks" to hide specific categories from casual visitors, so this is a bit disconcerting.

Andy · March 27, 2008

mbellot wrote:

OK, then how about an option to simply disable the iphone link globally for a user account (like hello world)?

I tried to get around it with a vanity url, but no luck.

I'm in the same boat as Stuart, using one of the "hacks" to hide specific categories from casual visitors, so this is a bit disconcerting.

I'm sorry I don't have a better answer for you now, but making galleries private will stop someone from seeing them on an iphone.

cdonovan · March 27, 2008

what the .....

If someone goes into my galleries, adds iphone it pops up every single one of my photos on the site.....unless it's password protected? What's more, I see when you look at the photos that they aren't right click protected and allow you to download them right to the computer

What is the work around for this

scratch

Andy · March 27, 2008

cdonovan wrote:

what the .....

If someone goes into my galleries, adds iphone it pops up every single one of my photos on the site.....unless it's password protected? What's more, I see when you look at the photos that they aren't right click protected and allow you to download them right to the computer What is the work around for thisscratch

NO, and see, the original poster has brought forth uncertainty from you.

/iphone will allow your public galleries to be seen. Unlisted & private galleries, no.

Try it: http://cdonovan.smugmug.com/iphone/

denisegoldberg · March 27, 2008

cdonovan wrote:

... I see when you look at the photos that they aren't right click protected and allow you to download them right to the computer. What is the work around for this

Right click protection is only available within your smugmug galleries. So if you make your images available elsewhere by allowing external links and those photos are displayed in the context of another application (for example, if you show a photo on a blog, or in a forum post), there isn't any right click protection. That's outside of smugmug's control.

You can disallow external access.
If you still want to allow external access, then it's probably a good idea to watermark your images. If you want to have external access for some but not all photos, you might consider putting copies of those photos in a separate gallery that is enabled for external access rather than allowing access to the full gallery.

--- Denise

stuartb · March 27, 2008

Extreme apologies Andy, I agree the word 'back door' is not entrely appropriate, a genuine error on my part and no intent to flame.

Leaving that to one side, I do feel my point remains valid. Allowing straight unfiltered access to my galleries (by-passing my CSS) de-values the benefit of my 'customization' (which was one of the reasons why I paid for the upgrade to Power User).

I am not complaining, just querying whether iphone access could somehow be made 'optional' to Smugmug customers.

cdonovan · March 27, 2008

Andy wrote:

NO, and see, the original poster has brought forth uncertainty from you.

/iphone will allow your public galleries to be seen. Unlisted & private galleries, no.

Try it: http://cdonovan.smugmug.com/iphone/

Well maybe I am jumping the gun but I went into a few galleries from that iphone link. Galleries that are right click protected and galleries that I have for my clients to see and that I sell from them. They are watermarked, but I am able to open them no problem, easy sharing and external links are turned off

This gallery For example http://cdonovanphotos.smugmug.com/gallery/2819944_WAd7S

Andy · March 27, 2008

cdonovan wrote:

Well maybe I am jumping the gun but I went into a few galleries from that iphone link. Galleries that are right click protected and galleries that I have for my clients to see and that I sell from them. They are watermarked, but I am able to open them no problem, easy sharing and external links are turned off

This gallery For example http://cdonovanphotos.smugmug.com/gallery/2819944_WAd7S

Log out, Christine?

cdonovan · March 27, 2008

I opened firefox, and I'm not logged into smugmug from there. Same thing. The galleries are not password protected, but in the customizer the external links and easy share is off. Is there another button or setting that I am missing? These photos are essentially free for the taking

Allen · March 27, 2008

cdonovan wrote:

I opened firefox, and I'm not logged into smugmug from there. Same thing. The galleries are not password protected, but in the customizer the external links and easy share is off. Is there another button or setting that I am missing? These photos are essentially free for the taking

Has nothing to so with that, the photos are being viewed in a browser with
the phone. The pages are just formated differently. Same photos you'd see in
any browser.

Andy · March 27, 2008

cdonovan wrote:

I opened firefox, and I'm not logged into smugmug from there. Same thing. The galleries are not password protected, but in the customizer the external links and easy share is off. Is there another button or setting that I am missing? These photos are essentially free for the taking

Yknow what? I have to look into that - stay tuned, thanks Christine.

stuartb · March 27, 2008

I can see quite a number of horse albums on your site Christine . . . using the /iphone at the end . . and obviously I am not logged in. I am guessing these are 'public' albums? The loss of right click protection is understandable (and cant people just screen-grab anyway?). My original point is that the /iphone version of public pics should be 'optional', because it works differently . . . especially if we have used CSS to hide categories (or right click protection) on our 'normal' homepage. It would be good if 'external links' being off was all that was needed to disable the iphone view.

cdonovan · March 27, 2008

They Are "public" albums in that they do not require a password to access them. They are not password protected as it allows the competitors the option to view them at their own leisure.

Dare I ask how long this "feature" has been available

I for one want to opt out of it.

ETA, thanks for looking into it Andy.

stuartb · March 28, 2008

Christine, its not a 'feature' as such, and its not a security breach or failing on the part of Smugmug. Its just a special page to display your public galleries in a format that iphones can display nicely. The problem is (for me at least) that if you have chosen to use CSS customization to 'hide' all your public photos on your 'normal' smugmug page (by not showing categories and running a slideshow for example) . . then the iphone format page undermines that as we have no ability to shield our public photos on the iphone page. Any browser can view the iphone page . . not just iphones.

It would be nice to have another level of control whereby only public galleries with 'external links' activated would show on the iphone page.

jeff318 · March 28, 2008

I agree with the OP. Although the iPhone interface is nice, it does not work well with what I am doing with Smugmug. An option to disable would be great.

cdonovan · March 28, 2008

Thank you for looking into it Andy.

This is seriously bothering me. Even more so since I've done a little forum search and see topics about it back as far as October of last year.

Can I ask exactly what the purpose of people having access to my galleries by iphone is?

I don't have an iphone, hell at Christmas, they weren't even being sold in Canada. Does this "feature" allow anyone with an iphone to just pop into my(or anyones) gallery and use the pictures? and for what use (screen saver, backgrounds, printing) What resolution do they appear in on the phones. Is this something that is advertised for the iphone consumer and owners. How and where is this being marketed? I know that smugmug is against emails and spam, but something like this is pretty important to warn about or mention, honestly I don't have time to spend reading through the forum for updates and possible problems. and alerts, and from Andy's reply it doesn't look like the team was even aware of the possibility of people lifting pictures from secure galleries.

The nature of my work, that I actually get paid for depends on the security of the photos online, why buy it when they can take it. This was originally why I choose smugmug. Some may think I'm flying off the handle here, really I'm not, I just need some answers.

Allen · March 28, 2008

cdonovan wrote:

Thank you for looking into it Andy.

This is seriously bothering me. Even more so since I've done a little forum search and see topics about it back as far as October of last year.

Can I ask exactly what the purpose of people having access to my galleries by iphone is?

I don't have an iphone, hell at Christmas, they weren't even being sold in Canada. Does this "feature" allow anyone with an iphone to just pop into my(or anyones) gallery and use the pictures? and for what use (screen saver, backgrounds, printing) What resolution do they appear in on the phones. Is this something that is advertised for the iphone consumer and owners. How and where is this being marketed? I know that smugmug is against emails and spam, but something like this is pretty important to warn about or mention, honestly I don't have time to spend reading through the forum for updates and possible problems. and alerts, and from Andy's reply it doesn't look like the team was even aware of the possibility of people lifting pictures from secure galleries.

The nature of my work, that I actually get paid for depends on the security of the photos online, why buy it when they can take it. This was originally why I choose smugmug. Some may think I'm flying off the handle here, really I'm not, I just need some answers.

I just tried saving one of my photos on a pocketpc/cell phone and the file is
only 32.1kb so they are very small. These devices only have a screen
display of about 2" diag. so don't need much of a file size for display.

Not anything to worry about.

mbellot · March 28, 2008

Allen wrote:

I just tried saving one of my photos on a pocketpc/cell phone and the file is
only 32.1kb so they are very small. These devices only have a screen
display of about 2" diag. so don't need much of a file size for display.

Not anything to worry about.

Allen, I'd say that was one man's opinion. I'm sure there are plenty of people who would be happy to just grab an image to use as a wallpaper on their phone and skip purchasing anything.

I'm with stuart on this one. The iphone page circumvents customization set up in the CSS section, we should have an option to "opt out" of access to our site via the iphone interface - especially since it can be accessed from any browser.

External links would be a good "already there" variable to decide what is and is not available to the iphone interface if there is no plan to allow users to opt out all together.

Andy · March 28, 2008

mbellot wrote:

The iphone page circumvents customization set up in the CSS section, we should have an option to "opt out" of access to our site via the iphone interface - especially since it can be accessed from any browser.

Not sure I agree with this part.

I do agree that the images should be protected, we'll see what can be done

stuartb · March 28, 2008

cdonovan wrote:

. . the possibility of people lifting pictures from secure galleries.

Christine, in fairness to Smugmug, if you set pictures as 'public' then they are not 'secure galleries'. This doesnt get us away from my original point that the way your images are available to iphones is certainly different and doesnt suit everyone, especially those who have customised their front end.

I am sure they are looking at the options . . . especially as others have requested access to passworded galleries via iphone.

Allen - the iphone resolution may only be 320x480 however the images can be 'zoomed-in' on the device, so the downloaded images are therefore much much larger . .just check http://www.photosbyat.com/iphone/#_home and you will see many of your images available as 600 x 800 or larger.

Allen · March 28, 2008

mbellot wrote:

... especially since it can be accessed from any browser..

I can then just switch to the browser (remove the /iphone link) on the phone
and get the same thing in a regular page format of those little bitty photos.
On a pc I can screen capture the much larger version of the photo. I really
don't see what the problem is, other then what's been available all along.

cdonovan · March 28, 2008

I'm answering a few of my own questions here...

http://www.appsafari.com/photos/1195/smugmug/

Access and browse public SmugMug albums on your iPhone with a great iPhone interface. Search feature allows searching for users or photos. See the most popular photos of the day, or of all time. Also features browsing for popular keywords of the day or of all time. The photos are resized on-the-fly by on the servers to perfectly fit the iPhone and the app also takes into account orientation (portrait / landscape) and shows you a different resolution. To speed up browsing only a few of your albums and photos are shown on first load and you can load more data as needed.
If you are a SmugMug member, you can get to your personal public photos by going to http://YOURNAME.smugmug.com/iphone/ . For example you can go to http://concours.smugmug.com/iphone/.

http://www.ghacks.net/2008/01/28/private-galleries-can-be-accessed-at-smugmug/#more-3020

<hr>  Private Galleries can be accessed at Smugmug

Posted by Martin in Hacking, Online Services, Security  Tags: download pictures, picture gallery, private galleries, smugmug

28
Jan

******** type="text/javascript">  

If you would use an image host, put up some of your images and set them to private, would you expect them to be still accessible by anyone ? This is apparently the case over at Smugmug where a private setting simply means that the pictures and image galleries are not directly linked from the homepage anymore but can still be accessed by simply entering the url directly in the browser address bar or download manager.
The real problem arises because files are named sequentially at Smugmug which means that anyone with just a little bit of technical knowledge will be able to download all images from all galleries set to public and private. The only galleries that are not accessible are the password protected ones obviously.
The urls for the galleries can be accessed by opening a url starting with http://www.smugmug.com/gallery/*, for example http://www.smugmug.com/gallery/1000, http://www.smugmug.com/gallery/1001 in your browser. Pictures can be accessed directly by loading http://www.smugmug.com/photos/*-M.jpg in your browser where * is a number between 1 and x. So, everyone can access pictures like http://www.smugmug.com/photos/1000-M.jpg, http://www.smugmug.com/photos/10001-M.jpg and so on.
Google Blogoscope who discovered this loophole contacted Smugmug and received a reply that was not that satisfactory. According to CEO Don MacAskill this is the intended way it should work:
First of all, we view security and privacy as two separate, but related, issues. Security is like locking your front door (no-one can get in with out a key) and privacy is like closing your window drapes (no-one can look in from the outside, but you can tell people where you live and they can visit without a key).
At SmugMug, the feature you’re talking about, private galleries, falls under the privacy umbrella, not security. It’s intentionally designed so that you can “tell other people” about your photos (share a URL in an email, embed or hyperlink on your blog or message forum, etc) without having to share something like a password. Only people you’ve shared this URL with can find the gallery and/or photos in question.

mbellot · March 28, 2008

Andy wrote:

Not sure I agree with this part.

I do agree that the images should be protected, we'll see what can be done

Andy,

I'm sorry, but which part don't you agree with?

The /iphone interface most certainly circumvents both java and CSS customization (ignores/drops may be a better choice of words for better viewing on such a small screen).

Allen wrote:

I can then just switch to the browser (remove the /iphone link) on the phone and get the same thing in a regular page format of those little bitty photos.

Allen, I guess the key question then would be whether or not images that are viewable in the /iphone interface suddenly disappear because I have used the hack to hide categories. If my site is accessed "normally" from an iphone browser (not using the /iphone interface) will my CSS and java customizations be active?

If so, then I would really prefer to be able to just turn the /iphone interface off completely via an option in the control panel.

Andy · March 28, 2008

Christine, and all:

I've put in a request to make it so /iphone from a browser won't allow saving. Thanks for pointing this out!

denisegoldberg · March 28, 2008

cdonovan wrote:

I'm answering a few of my own questions here...

http://www.ghacks.net/2008/01/28/private-galleries-can-be-accessed-at-smugmug/#more-3020

But that private galleries blog was clearly addressed with the February 8th security and privacy release - http://www.dgrin.com/showthread.php?t=83916&highlight=privacy+security. And the galleries that used to be tagged as private are not assigned the more correct name of unlisted.

--- Denise

mbellot · March 28, 2008

Andy wrote:

Christine, and all:

I've put in a request to make it so /iphone from a browser won't allow saving. Thanks for pointing this out!

How about an option to turn it (/iphone) off completely?

Andy · March 28, 2008

mbellot wrote:

How about an option to turn it (/iphone) off completely?

I really think this would set a bad trend going. If you have public galleries, there's no big deal, IMO.

cdonovan · March 28, 2008

stuartb wrote:

Christine, in fairness to Smugmug, if you set pictures as 'public' then they are not 'secure galleries'. This doesnt get us away from my original point that the way your images are available to iphones is certainly different and doesnt suit everyone, especially those who have customised their front end.

I am sure they are looking at the options . . . especially as others have requested access to passworded galleries via iphone.

Allen - the iphone resolution may only be 320x480 however the images can be 'zoomed-in' on the device, so the downloaded images are therefore much much larger . .just check http://www.photosbyat.com/iphone/#_home and you will see many of your images available as 600 x 800 or larger.

In my(what I refer to as) secure galleries, I have external links turned OFF and have easy share turned off, they are watermarked and right click protected. They are not hidden or password protected(or rather before today) to allow my clients the ability to find them easier without waiting for me to get back to them with an email about the password. Personally, if I was my client and came up against a password protected gallery, I'd probably loose interest and wonder why the password was needed, I'd wonder if it was a tactic to capture my email address for marketing purposes etc. Is there not a whole page dedicated to selling security when signing up for a pro account????

I know that any joe blow can go and do a screen capture, but this is something advertised and promoted to iphone consumers.

I guess what I don't understand is why we are allowing iphone browsers the ability to go and lift our photos (regardless of the size of file) What is different from this and free stock images?

Am also trying to figure out when this feature was implemented, are there any other extensions for products that I should know about that allow similar access?

Andy · March 28, 2008

cdonovan wrote:

I guess what I don't understand is why we are allowing iphone browsers the ability to go and lift our photos (regardless of the size of file)

This isn't true. The /iphone respects the file sizes you limit in your gallery settings. We need to address the right click when it's used in a non-iphone browser.

Option to disable the iphone 'backdoor'?

Comments