Big changes to SmugMug's privacy and security released

[Baldy]

What:

1. SmugMug gallery URLs are now appended with an underscore and 5 alpha-numeric characters, and so are image URLs. We call them keys. URLs with both gallery and image numbers will have two keys. Occasionally, you'll see an URL with three keys.

2. Where we used to call galleries private, we now call them unlisted.

3. When you create a gallery, we used to offer two options: public and private. Now we offer three: public, unlisted, and lock it down.

Lock it down means we ask you to set a password, we make it unlisted, we turn off external links, and we turn right-click protection on in the case of pros.

Why:

1. The keys are to make it much harder (but not impossible) to find unlisted galleries and photos via guessing URLs.

2. The word unlisted was chosen because the word private meant different things to different people.

Unlisted means that it doesn't appear to your visitors unless they're logged in as you. If you give the link to someone, however, they can get right in without a password. It's like an unlisted phone in the U.S. If you give it out, people can call it.

Gotchas:

1. Galleries and images uploaded before this change are grandfathered. That means the olde links to them still work, so posts in forums and blogs will work as always.

It also means they are as easy to guess as they were before this change. It seems that most of our customers are not concerned about this but some are very concerned, and hence the change.

2. If you are concerned, you can place a password on your grandfathered galleries and turn external links off. Or you can move your photos to new, unlisted galleries. If you set a password, your old links to forums and blogs will continue to work as long as you don't turn external links off. If you move them to new galleries, the old links will break. We're really sorry to say that. If you move them back to grandfathered galleries, they will work again.

3. Grandfathered galleries and images will look to you like they have keys now, so any new links you make will contain those keys. If you move a grandfathered image to a new gallery some time in the future after posting a link with its keys, it won't break.

Clear as mud?! Here are some discussions that led to these changes. Many thanks to everyone who chimed in, and we're sorry for some of the compromises we felt we had to make for the sake of scalability or whatever.

Questions?

Bugs? We're standing by and holding our breath!

[jogle]

Originally Posted by Baldy

What:
2. If you are concerned, you can place a password on your grandfathered galleries and turn external links off. Or you can move your photos to new, unlisted galleries. If you set a password, your old links to forums and blogs will continue to work as long as you don't turn external links off. If you move them to new galleries, the old links will break. We're really sorry to say that. If you move them back to grandfathered galleries, they will work again.

Thanks for moving so quickly, I realize this kind of change is a huge headache.

After some testing over a few days I would be happy to move all my galleries to the new keyed setup. Are you planning a tool, like for smugmungus, where you can update all the galleries or maybe even my whole site in one step?

[denisegoldberg]

Thank you for not breaking my existing links to my photos and galleries - that was very very very important to me.

--- Denise

[devbobo]

Originally Posted by jogle

Thanks for moving so quickly, I realize this kind of change is a huge headache.

After some testing over a few days I would be happy to move all my galleries to the new keyed setup. Are you planning a tool, like for smugmungus, where you can update all the galleries or maybe even my whole site in one step?

I doubt that is going to happen at this stage, but since you are familiar with the api...I am sure that you could easily write something that would address this

[digitalpins]

thanks for this and thank you for keeping our old links the way they are... wow that was fast just a week ago this was talked about.

Awesome job smugmug

[JenGrace]

I created a test gallery for a moment. At the creation point, I was offered the three options. But when I hit customize gallery, I only got public and unlisted. So the only chance to put a gallery on 'lockdown' is when I create it, correct?

[devbobo]

Originally Posted by JenW

I created a test gallery for a moment. At the creation point, I was offered the three options. But when I hit customize gallery, I only got public and unlisted. So the only chance to put a gallery on 'lockdown' is when I create it, correct?

Jen,

I believe that the 'Lock it down' option is a shortcut for setting a gallery password, and the SmugIslands and External Links settings to no. Plus sets Protected to YES for pro accounts.

Cheers,

David

[rainforest1155]

Originally Posted by JenW

I created a test gallery for a moment. At the creation point, I was offered the three options. But when I hit customize gallery, I only got public and unlisted. So the only chance to put a gallery on 'lockdown' is when I create it, correct?

Jen, this is a valid question. Lockdown basically just sets a gallery to unlisted, adds a password, sets SmugIsland settings to no and disables external links. If you're a Pro, protection will be enabled as well. You were all ready able to set all of these settings prior, but we didn't have this one-click setting to engage all these locks at once.

Sebastian

[Andy]

Originally Posted by JenW

I created a test gallery for a moment. At the creation point, I was offered the three options. But when I hit customize gallery, I only got public and unlisted. So the only chance to put a gallery on 'lockdown' is when I create it, correct?

On the create page, we make the lockdown button just for a quick convenience - for new customers and for any customer that hasn't set a gallery quicksetting.

On the gallery customize page, ALL the options are available to you, on an individual gallery basis, or, if you use a quick setttings template, you can apply it to all your new galleries as you make 'em :)

http://www.smugmug.com/help/picture-storage

Holler if you need more help :) Thanks!

[JenGrace]

Dur! Silly me... I just realised that upon rereading baldy's IP. Chalk that one up to posting less than an hour after waking up.

[dmc]

FYI at this point... (I haven't looked at the code yet)... but the Customization for Journal Large has stopped working... I will post in the Customization area as well.

... yes, I'm still around..... I know, I've been quiet...

I got my cool Camera strap yesterday though! Thanks!

[jfriend]

Am I correct that a pre-existing gallery can be referred to by either the old link or the new link with keys?

I am using several RSS feeds to my mom's picture frame. Is there any reason to update those feeds to the new keyed gallery link? Or, can I just leave it the way it is forever?

[darryl]

Anything other new features released? :-}

[Andy]

Originally Posted by jfriend

Am I correct that a pre-existing gallery can be referred to by either the old link or the new link with keys?

I am using several RSS feeds to my mom's picture frame. Is there any reason to update those feeds to the new keyed gallery link? Or, can I just leave it the way it is forever?

Should be able to leave it. Let us know if you find out otherwise.

[Andy]

Originally Posted by darryl

Anything other new features released? :-}

No, this was a huge effort, and consumed us all for the past 10days - 2weeks. Hopefully we can now get back to our regularly scheduled Sorcery, and make some cool new stuff

[jfriend]

I use some RSS feeds on some unlisted galleries. The images aren't so much private as I just don't want them listed on my homepage because they're a particular collection just for these RSS feeds (which go to picture frames), not for regular browsing.

As of today, it seems like RSS feeds don't work to new unlisted galleries which is a feature regression. They are still working for pre-existing unlisted galleries. Is this the intended behavior?

Here's an example:
Unlisted test gallery: http://jfriend.smugmug.com/gallery/4302566_3hBNK

RSS feed from that gallery:
http://jfriend.smugmug.com/hack/feed...&format=rss200

The RSS feed returns only one line of XML.

I would like RSS feeds to work on unlisted galleries. Since the RSS feed requires the gallery number, they offer no less security than just typing the gallery URL. In either case you have to know the gallery number including the new key so there should be no security issue with allowing RSS feeds on unlisted galleries.

[geary]

I often post images from SM to my blog and other web sites. In the past, the URL for each image could be built from the image ID which was easily copied from the URL while browsing. Now I have to click through to the "share" page for each image. This is a huge pain. Is there any why do make this easier?

Examples:
http://msg150.com
http://www.acaciafarm.com/horses/Titan

[jfriend]

Originally Posted by geary

I often post images from SM to my blog and other web sites. In the past, the URL for each image could be built from the image ID which was easily copied from the URL while browsing. Now I have to click through to the "share" page for each image. This is a huge pain. Is there any why do make this easier?

Examples:
http://msg150.com
http://www.acaciafarm.com/horses/Titan

Just click on the image to open the lightbox and you'll see the whole image ID with key in the URL bar and you can copy from there. One extra click.

Or right click on the main image and choose properties to see the direct image URL and copy the ID+key from there.

[geary]

Originally Posted by jfriend

Just click on the image to open the lightbox and you'll see the whole image ID with key in the URL bar and you can copy from there. One extra click.

Thanks. It would still be nice if the code in the URL in the standard view included the key, but this will work.

[Andy]

Originally Posted by jfriend

I use some RSS feeds on some unlisted galleries. The images aren't so much private as I just don't want them listed on my homepage because they're a particular collection just for these RSS feeds (which go to picture frames), not for regular browsing.

As of today, it seems like RSS feeds don't work to new unlisted galleries which is a feature regression. They are still working for pre-existing unlisted galleries. Is this the intended behavior?

Here's an example:
Unlisted test gallery: http://jfriend.smugmug.com/gallery/4302566_3hBNK

RSS feed from that gallery:
http://jfriend.smugmug.com/hack/feed...&format=rss200

The RSS feed returns only one line of XML.

I would like RSS feeds to work on unlisted galleries. Since the RSS feed requires the gallery number, they offer no less security than just typing the gallery URL. In either case you have to know the gallery number including the new key so there should be no security issue with allowing RSS feeds on unlisted galleries.

We'll check into it - it's on Devbobo, who's in Australia, so he's asleep right now but I've made sure he's seen the issue. Thanks!