Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Friday, February 3, 2012

How are watermarks typically used in images?

Question

How many watermarks(number) are used on an image commonly? What type of watermarks are used?

Answer

A single watermark is most common, and mainly serves as a notice that the image is copyrighted. A single watermark is often easily removed with editing, like photoshop's content-aware fill. They tend to be a semi-opaque grey in order to not ruin the picture entirely, while being visible enough to serve their purpose.

An important point is that an image is copyrighted at the moment it is taken, and this is unaffected by the presence or absence of a watermark. So adding a watermark does not increase your legal protection.

They can also be used as a branding tool to advertise a photography business, as opposed to trying to discourage misuse of the image. A name and website so anyone who likes an image they see online can search and find the photographer.

Some agencies, like this one for example, cover their images with their watermark making it very difficult to remove.

Apart from visual watermarks, there is also digital watermarking, which is quite a different thing. This is not visible to the eye, but is embedded in the image (the best analogy I know if is to compare it to digital noise in an image). A lot of information can be encoded into the digital watermark. For example, if you licensed an image to several clients, you could embed unique IDs in each copy so that if they were used elsewhere, you would know which of the images it was.

Friday, September 2, 2011

How secure is Flickr's "disable download of original image" feature?

Question

In the Flickr privacy settings page there's a setting entitled "Who can access your original image files?". If I set this to anything other than "Anyone" (e.g. "Only you" or "Your contacts"), is it still possible for an unauthorised user to access the original image without someone giving them the URL for it? (Assume that my original photo is larger than 1024px, so there's an Original version distinct from the Large version. Also assume it's not Creative Commons licensed.)

I'm well aware that once an image has appeared in their browser, a determined user can easily download it regardless of any disincentives (e.g. JavaScript blockers) the browser tries to put in their way. However, I believe the following are correct:

  1. An unauthorised user will just see an error page if they try to view the Original Size page on Flickr (e.g. this page).

  2. Although the URL of that page is easily guessable (just add sizes/o/ to the end of the regular photo page URL), the URL of the actual original image file has a random component and cannot easily be guessed.

There are plenty of people on Flickr and elsewhere saying the disable download setting is useless, but I haven't seen any proof. Does anyone know for certain that it can be bypassed? If you say yes, I'll expect you to prove it by sending me the original size of my latest image! (It's meant to be available to friends & family only - so not you, Uncle Goober...)

Some context: I should point out I'm not looking to steal photos, I'm trying to understand how safe mine are, specifically with regard to this geofences loophole that was reported today.

Answer

I did some investigation on my own, using my own flickr account and a non-logged in browser.

Here's the All Sizes page for one of my photos.

Prior to me changing the "Who can access your original image files?" setting in Privacy & Permissions, a generic Internet user could see the "Original" link in addition to the other sizes. That page had an <img> tag that linked to this url. The "All Sizes" page also had a link that said Download the Original size of this photo. (If you check the URLS, note that there's a _d suffix on the file name; Flickr will see this and trigger the HTTP header that tells the browser to download instead of display the image).

For comparison, here's the Large size page and the corresponding image URL.

Then I changed the privacy setting, cleared the cache on my non-logged-in browser, and recheceked the links. Here's what I found:

  • The link to the original size page now redirects to the large size page. That's reasonable.
  • The All Sizes page didn't have the Original size links any more, as expected.
  • I was still able to download the original size image
    • This is a bit surprising. It means that, while there's access restrictions on the pages containing the images, theres no security on the images themselves.
    • As a web developer I can understand why they probably did this. The images are large and static and probably served via a content delivery network. It's faster/more efficient to not check permissions for image files; you can simply host them on a "dumb" web server that way.

So, once the URL for the original file is known, there's no way to stop someone from downloading the original version of the file (short of deleting it entirely... and that may not even work. I didn't try).

One last issue: how guessable are the original file URLS? Here they are side-by-side:

Large:    http://farm7.static.flickr.com/6126/6044833128_cc02cf41e3_b.jpg
Original: http://farm7.static.flickr.com/6126/6044833128_3b8eac89d7_o.jpg

So, the suffix (_b or _o) determines the size, but there's also another element in the filename that varies depending on the size. You can't just change the suffix to flip sizes. Here's the URL for the Large version with the suffix switched to _o; it doesn't work.

If I was Flickr, I'd make sure that that middle element was completely random per photo size, and hence unguessable except by brute force attack. It's 40 bits long, so there's a lot (2^40, ~1 Trillion) of possible options. It's very unlikely anyone would bother to brute-force that segment just to get the original size version of a file... when they already have the large version.

So, as long as you've turned off the "Original file download" feature and you don't share the URLs of the original images, I'd say that the Flickr feature is pretty secure. If it breaks, it's pretty much your own fault.

Tuesday, August 16, 2011

How should I pack equipment when travelling in countries with high crime rates?

Question

I'm going to travel individually in Sub-Saharan Africa where the crime rate is high. Most of the time I will do landscape photography and only a few shots in urban areas. I've been there already, but without valuable camera gear. I'm not sure if I should strip down my equipment to low budget but evidently suffer loss of quality and focal range.

How do you pack your stuff when travelling such regions? What is your experience?

Answer

I live in a country where crime-rate is quite high but that doesn't prevent the photographers here from buying/using expensive gears. All you have to do is be a little more careful than usual. I'd suggest:

  1. Avoid lone journeys. If possible gather a group of people.
  2. Use public transports as much as possible avoiding taxis.
  3. Try to avoid late night and too early in the morning shootings.
  4. Be as inconspicuous as possible. Prefer black lenses over the white ones!
  5. Ask hotel/resort manager about the place before going to shoot there.
  6. If possible, ask someone local to assist/accompany you during your walks.
  7. Do not carry any company branded (Canon/Nikon etc) camera bag. Use something that doesn't make it obvious that you're carrying expensive gears.

One of my friends once got in the hand of a group of thugs. He introduced himself as a journalist of a local leading newspaper and later successfully managed to escape them paying a few dollars only for their treat. Just in case, you might use the trick! =)

EDIT: It just came to mind, several companies offer insurance for your photographic equipments. If you're seriously worried, you can try reading through their offers and get a suitable plan for you. A simple google search helps!