1

Facebook claims to allow restrict sharing to friends, certain network, or even custom when I upload photos.

enter image description here

But it appears that this security is only in effect for the page where the photo is hosted. One can use the "Copy image URL" or the equivalent in one's browser, and you can forward this URL to anyone, who will be able to see it without even logging in to Facebook.

This looks weird, because I've seen companies without a superstar IT security team be able to restrict their images/resources with LDAP or something similar. Why can't Facebook do this?

1
  • What's the point? It doesn't improve security much, since you can just as easily choose "Copy image". This is an example of capability based security, which is a fine model for immutable data. Feb 23, 2014 at 9:37

1 Answer 1

1

Images are available through a CDN. This promotes faster loading and lower system load. It's also rather crucial for anything that's marked as public content.

Since users can still copy and reupload images (to Facebook or elsewhere), the value of preventing CDN access to a known URL is very low. The technical complexity to add ACL rules is not immense, but it does increase complexity while providing little-to-no value, require remote caching and code evaluation (probably not the kind of thing you want a 3rd to handle or have access to), and increases hardware costs.

Thus, the benefit is next-to-nothing and the cost, though not immense, is substantial.

Not the answer you're looking for? Browse other questions tagged .