Password ******'s

Allen · August 4, 2013

Who ever thought of this should shot! All we see are ******'s in the password block in the gallery
settings. Get a life, we are already logged in and logged in (with a password) .
Why the double log in?

Those with a lot of clients can not possibly remember all those past PW's. In the future I guess they can
write them down.
I have to go into browser tools, options, PW's to see what PW's are for five sites. I remember my main
site because I have to put it in every time because the browser does not recognize the log in page as a
password page.

paulbrock · August 4, 2013

utterly ridiculous. Gallery passwords should be visible to the site owner. Always.

mbonocore · August 4, 2013

Allen wrote: »

Who ever thought of this should shot! All we see are ******'s in the password block in the gallery
settings. Get a life, we are already logged in and logged in (with a password) .
Why the double log in?

Those with a lot of clients can not possibly remember all those past PW's. In the future I guess they can
write them down.
I have to go into browser tools, options, PW's to see what PW's are for five sites. I remember my main
site because I have to put it in every time because the browser does not recognize the log in page as a
password page.

Allen, We have heard your feedback on this.

Michael

Allen · August 5, 2013

mbonocore wrote: »

Allen, We have heard your feedback on this.

Michael

Sorry Michael, had a bad day.

mbonocore · August 5, 2013

Allen wrote: »

Sorry Michael, had a bad day.

It's all good Allen...you know I can take it

AndreasV · August 6, 2013

When I inform my customer about URL and Password I copy the URL from "Folder settings/Basics/below Custom URL" and I type the gallery's password.
If the password is forgotten by me or the customer, I need to do research in my emails.

My suggestion: Create a button "Copy URL/Password to clipboard". It will copy URL and password to the clipboard, ready to paste into an email.
Andreas

bentleyg · August 6, 2013

+1 This needs to be addressed quickly. I own the account and should be able to view all passwords when logged in. What if I have an event where multiple clients have the password, but one person forgets? I would have to change it if I don't remember it. Then the other clients would need the new password.

Baldy · August 6, 2013

I'm really sorry guys. I know this is an inconvenience and caught you by surprise, but we felt we had to get to a level of security where even we don't know the passwords.

Allen · August 6, 2013

Baldy wrote: »

I'm really sorry guys. I know this is an inconvenience and caught you by surprise, but we felt we had to get to a level of security where even we don't know the passwords.

In other words it sounds like you are implying that our site log in with a password is not secure?

"even we don't know the passwords"
If we can't trust Smugmug with our site who can we trust?

mishenka · August 6, 2013

Allen wrote: »

In other words it sounds like you are implying that our site log in with a password is not secure?

"even we don't know the passwords"
If we can't trust Smugmug with our site who can we trust?

I think what Baldy is saying is that in a New SM passwords are encrypted with one way cipher and no one really knows the passwords:) That is fine and I agree this is the level of security that is a acceptable nowdays. Systems that I design also have security where even I do not know the password. But here is a suggestion, SmuMug: why don't you provide an option for a password recovery for a site owner? Yes, it did caught many people by surprise. What surprised me personally is that there is no recovery option for a gallery password.

On a related note - how come legacy smugmug still have the password in clear text for the same gallery??

paulbrock · August 6, 2013

@mishenka,smugmug does have access to our photos though! It makes no odds to either smugmugs customers or to their customers customers whether or not they see the password. But there are, security factors at play.

Sent from my GT-I9100 using Tapatalk 4 Beta

Allen · August 6, 2013

Before they are caught by surprise I think a notice should go out to every Pro that has not
unveiled to copy all those passwords from their legacy site and save them.

BigRed · August 7, 2013

Allen wrote: »

Before they are caught by surprise I think a notice should go out to every Pro that has not
unveiled to copy all those passwords from their legacy site and save them.

Why only Pro's?

bentleyg · August 7, 2013

Baldy wrote: »

I'm really sorry guys. I know this is an inconvenience and caught you by surprise, but we felt we had to get to a level of security where even we don't know the passwords.

I'm sorry but with all due respect that isn't acceptable. If I didn't trust your company, I wouldn't be paying you to host my images. I'll say it again: It is ridiculous that the owners of the accounts cannot view the passwords to their galleries. This is going to cost me time and probably money in lost sales. My renewal date is coming up very soon so I'll be watching this closely. Sorry to say that, but this is a huge step backwards in my opinion. And as someone else mentioned, a little warning would have been nice.

renstar · August 7, 2013

If I am reading between the lines correctly, this has nothing to do with trust between you and SmugMug. Storing the hashed, salted password and not the plaintext is far more secure from the SmugMug perspective.

If someone managed to gain access to SmugMug's password database, if the gallery passwords are in plaintext, unauthorized users could easily gain access to the things you don't want them to (or are contractually or legally obligated to not share with others), potentially opening you and SmugMug up to legal risk.

bentleyg wrote: »

I'm sorry but with all due respect that isn't acceptable. If I didn't trust your company, I wouldn't be paying you to host my images. I'll say it again: It is ridiculous that the owners of the accounts cannot view the passwords to their galleries. This is going to cost me time and probably money in lost sales. My renewal date is coming up very soon so I'll be watching this closely. Sorry to say that, but this is a huge step backwards in my opinion. And as someone else mentioned, a little warning would have been nice.

paulbrock · August 7, 2013

what is the likelihood of a hacker choosing to target a photo sharing site just to look at some private photos, I wonder. (versus targetting banks, social networks, anywhere that holds credit card info, email accounts etc)

I am struggling to understand this new focus on security issues, it does not seem to have been driven by customers.

renstar · August 7, 2013

Think about this. How many people use something like PasswordSafe to generate site specific passwords and how many just reuse the same password everywhere? I'd wager that far more people just reuse passwords. OK, now if it is obvious what your facebook account is from your smugmug page (many people link them...), that is access to perhaps enough personal information to go a few more steps down the chain to doing some serious damage. "Low value" sites like smugmug are actually great targets for the unscrupulous because if they skimp on security, they can give great information about those more important sites you suggested.

(This may not be 100% relevant to all gallery passwords, but perhaps it is valid for personal accounts and family photos.)

paulbrock wrote: »

what is the likelihood of a hacker choosing to target a photo sharing site just to look at some private photos, I wonder. (versus targetting banks, social networks, anywhere that holds credit card info, email accounts etc)

I am struggling to understand this new focus on security issues, it does not seem to have been driven by customers.

paulbrock · August 7, 2013

these aren't personal passwords though. Pretty much by definition they are going to be shared with others. Your argument holds for the smugmug account password, but not so much for gallery passwords, which, as far as I can tell, will be known to at least two people (site owner, and intended audience). So I think it unlikely that site owners would use their Facebook/email/bank passwords for these.

bentleyg · August 7, 2013

We aren't talking about nuclear launch codes here. If someone hacks into smugmug's database, they won't be doing it to look at pictures.

Here's my scenario, which is exactly what just happened to me:

Shot a wedding in 2009. Parent of the flower girl contacted me to get the link so she could order prints. Unfortunately I don't remember the password from that long ago, and since I can no longer see my own passwords, I have to change the password for this gallery. Now what happens when someone else wants to order prints and they try to use the original password? I know it may sound like a minor inconvenience, but it makes me look unprofessional if I can't quickly retrieve a password for a client, and could potentially cost me sales.

kimbomac · August 8, 2013

I have also been stuck not knowing what the password is to a gallery and had to unnecessarily change it. There has got to be a way for the website owner to retrieve a password. Perhaps, if it is not directly displayed for all the security reasons quoted, then the owner should be able to click a request button for it, perhaps enter their Smugmug password and then have it displayed to them or even emailed to them, if they think it's a password they don't want displayed on the open web.

That way, we can at least not look like idiots to our clients when we don 't know the passwords we assigned to them! Mine are all different for every client!

mcgil · August 21, 2013

Same feedback here. Got thousands of galleries, most of them sharing a master password, but some of them have "event" passwords which I now cannot retrieve and cannot even update without re-communicating to all customers of these galleries.

Thanks
McGil

AceCo55 · August 21, 2013

I can appreciate that Smugmug thinks they need to go this way ... but what is mind boggling is that they gave customers NO WARNING that this was going to happen.
They gave customers NO OPPORTUNITY to work within the new structure and make contingency plans.
They announced the new Smugmug with fanfare and encouraged people to unveil ... only to find out AFTER the event, that all of their password galleries were basically screwed. Had customers known, they could have done something about it BEFORE unveiling.
What Smugmug has done, is basically wiped/destroyed all the previous passwords (especially for those that have many, many password galleries)
It doesn't really affect me - at the time of migrating I only had one password gallery and I can easily let that family know what the new one will be ....... BUT
to unilaterally change the password views, WITHOUT LETTING THE CUSTOMERS KNOW, is just a train wreck of monumental proportions.

southeasternphotography · August 23, 2013

Allen said "Before they are caught by surprise I think a notice should go out to every Pro that has not
unveiled to copy all those passwords from their legacy site and save them.
__________________"

Allen, shame on you. You are asking for a pro-active response:wow

Like they did for the rollout so no one would be caught unaware about all the functionality that we were going to lose. Like they did to let us know that those with javascript would lose it all. Like that the themes we were currently using were going to be different. Like, ok, I'll stop here.:D

+1 to your request, but I have never received an email from SM about changes EXCEPT the get ready for the New SmugMug....

lynchpics · October 22, 2013

bentleyg wrote: »

I'm sorry but with all due respect that isn't acceptable. If I didn't trust your company, I wouldn't be paying you to host my images. I'll say it again: It is ridiculous that the owners of the accounts cannot view the passwords to their galleries. This is going to cost me time and probably money in lost sales. My renewal date is coming up very soon so I'll be watching this closely. Sorry to say that, but this is a huge step backwards in my opinion. And as someone else mentioned, a little warning would have been nice.

I just ran into this problem last night. Fortunately, I guess, I have not unveiled yet so I can go into legacy and WRITE DOWN every password.

I take it, nothing has been done to resolve this problem. And yes, it is a problem.

updeinva · November 2, 2013

I agree that the password should be visible to the owner. We log in so we can gain access to all the back end stuff. Very frustrating when we cannot read our own settings. Sure, keeping an external database is an option, but mostly it is a pain and inconvenience.

Password ******'s

Comments