Slashdot Mirror


Facebook Images To Get Expiration Date

Pickens writes "BBC reports that researchers have created software that gives images an expiration date by tagging them with an encrypted key so that once this date has passed the key stops the images being viewed and copied. Professor Michael Backes, who led development of the X-Pire system, says development work began about 18 months ago as potentially risky patterns of activity on social networks, such as Facebook, showed a pressing need for such a system. 'More and more people are publishing private data to the internet and it's clear that some things can go wrong if it stays there too long,' says Backes. The X-Pire software creates encrypted copies of images and asks those uploading them to give each one an expiration date. Viewing these images requires the free X-Pire browser add-on. When the viewer encounters an encrypted image it sends off a request for a key to unlock it. This key will only be sent, and the image become viewable, if the expiration date has not been passed."

306 comments

  1. Debunked by thetagger · · Score: 5, Insightful

    Slashdot users debunk this scheme as stupid in 5... 4... 3...

    1. Re:Debunked by Manfre · · Score: 1

      Bravo!

    2. Re:Debunked by caffeinemessiah · · Score: 5, Insightful
      This can be debunked quite easily: once an image is decrypted, it is forever decrypted. Alternatively, all I have to do is comment on your post of the image with the key I just downloaded for it while it was still valid. Even more alternatively, I could set up a counter-service to this that stores retrieved keys permanently and hands them out publicly. Unless the service is refreshing the image data every single day with a new key, in which case: (a) they will run out of bandwidth and CPU in a week, (b) they will hit facebook's limits very very soon, and (c) I still have copies of yesterday's encrypted data and yesterday's key.

      Oh yes, and your friends will not be able to see your pictures unless they download a plugin ("huh...what's that??"), and possibly use a specific browser ("huh? why?").

      So yeah, pretty stupid overall. This is another sad attempt at a form of DRM.

      --
      An old-timer with old-timey ideas.
    3. Re:Debunked by caffeinemessiah · · Score: 5, Insightful

      I should also add: why not just have a service to delete the image automatically from facebook after N days? Encryption is absolutely not needed here and achieves nothing.

      --
      An old-timer with old-timey ideas.
    4. Re:Debunked by durrr · · Score: 1

      Here's an even better solution: Print screen.

    5. Re:Debunked by Anonymous Coward · · Score: 0

      we're not going to debunk it. it's hard enough to be understandable without the shift key; now you want to dmca-forbid our printscreen button too?

    6. Re:Debunked by Anonymous Coward · · Score: 1

      It'd make sense.

      With their current privacy policy, they'd do something like put your phone number and the original file name on a black background with white text, and a line below it telling people to contact you to get a copy of the image. Or the default time for the image to persist would best be measured in generations, and apps would have free access to the images even when they are expired.

    7. Re:Debunked by Anonymous Coward · · Score: 0

      Yes, in KDE the PrtSc button opens up KSnapShot. In Windows, ctrl-PrtSc copies the screen to memory for pasting in any image editing program.

    8. Re:Debunked by Anonymous Coward · · Score: 0

      Although, this only seems like another failed attempt of enforcing some sort of DRM on images. I'd assume that the plugin tries to disable activities like print, or print-screen, or the sort. Which leads probably to another plugin called X-pirated software or the like.

    9. Re:Debunked by Anonymous Coward · · Score: 0

      My thought exactly. They needed 18 months to develop this and didn't even come up with the fact that their solution is equivalent to the most obvious solution?

    10. Re:Debunked by MoonBuggy · · Score: 2, Insightful

      That would make an awful lot more sense. I was about to reply to your initial post pointing out that while it may be a poor idea from a technical standpoint, the fact is that 90% of the images wouldn't be cracked and stored, and thus it would prevent them from resurfacing embarrassingly a decade later. If you're trusting the outside service with your pictures anyway, though, they may as well just have a deletion date instead.

      Of course, the truly sensible idea would be for users to be somewhat selective about what they upload, on the one hand, and for people in general to accept that we've all done stupid shit, someone will probably find out eventually, and everybody should just get over it, on the other.

    11. Re:Debunked by kaizendojo · · Score: 1, Insightful

      Here's an even BETTER better solution. How about people start acting like thinking beings and use their heads before posting instead of expecting the government or some technology nanny state to clean up after them.

    12. Re:Debunked by Anonymous Coward · · Score: 0

      Forget those, how are you going to get everyone to use your shitty plugin?

    13. Re:Debunked by SuricouRaven · · Score: 1

      You're over-thinking it.
      *printscreen* *paste*

    14. Re:Debunked by TheSpoom · · Score: 1

      In fact, someone should create, say, a Greasemonkey script that will look for such postings of "encrypted" images and automatically post the key as a comment (and to your wall as well, so they can't just delete the comment).

      This is just stupid in so, so many ways.

      --
      It's better to vote for what you want and not get it than to vote for what you don't want and get it.
      - E. Debs
    15. Re:Debunked by natehoy · · Score: 4, Insightful

      My thought exactly. They needed 18 months to develop this and didn't even come up with the fact that their solution is significantly inferior to the most obvious solution?

      So close... :)

      Deleting the image from Facebook is forever, if you trust Facebook. If you don't trust Facebook, then you might as well assume they are using a scripting tool to crank through the encrypted images as soon as they are posted and taking an unencrypted copy for themselves.

      This allows easy copying until the image is expired, and in a week there'll be a deXPire on every Linux repository that will ensure easy copying after the image is expired. Deleting the image makes it unavailable for everyone who hasn't already made a copy. "X-Piring" the image makes it and all other "expired" images available to anyone who wants to go to the trouble of "apt-get install deXPire-mozilla-plugin".

      --
      "This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
    16. Re:Debunked by natehoy · · Score: 1

      the fact is that 90% of the images wouldn't be cracked and stored,

      No, but they'll still be stored, and can easily be cracked later.

      If this comes out, I predict that someone will release an alternative plugin that is freely available, decrypts all images, uses less resources, has fewer licensing issues, and just happens to ignore the expiration date. "deXPire", anyone?

      The first image goes up, and the race is on. My money's on the cracking community. MPAA's spent a shitload of money trying to defeat them, as has RIAA, and Sony, and many others. It's a race they can't win. But it's cute to watch them scurry around and try.

      --
      "This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
    17. Re:Debunked by Weaselmancer · · Score: 1
      --
      Weaselmancer
      rediculous.
    18. Re:Debunked by scot4875 · · Score: 1

      How on Earth do you get from the topic at hand to government or "technology nanny state"? Paranoid much?

      --Jeremy

      --
      Jesus was a liberal
    19. Re:Debunked by Dishevel · · Score: 1

      I kind of like having a quick and easy way to identify the terminally stupid.

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    20. Re:Debunked by calmofthestorm · · Score: 1

      "Every young person one day will be entitled automatically to change his or her name on reaching adulthood in order to disown youthful hijinks stored on their friends’ social media sites."
      -- Eric Schmidt

      --
      93rd rule of Slashdot: No matter how obvious my sarcasm is, my comment will be taken seriously by someone.
    21. Re:Debunked by FunkyELF · · Score: 1

      Agreed.
      Completely idiotic.

      What does this system do that couldn't be solved with an alter table statement to add an expiration date field on photos and a cron job to delete expired ones?
      Who the hell wants to install a browser plugin.
      Hey... 1995 called, it wants its browser plugins back.
      Facebook runs on hundreds (?) of platforms besides a browser.... completely idiotic.

      What the hell does it take to be called a "researcher" these days?

    22. Re:Debunked by InlawBiker · · Score: 1

      It is a ridiculous idea that will never work. But, it might be fun to use just to piss off Facebook.

    23. Re:Debunked by KarlMalden · · Score: 1

      Let me get this:
      Step 1. You can take a screenshot.
      Step 2. Somebody thinks of xxxxxxxx based xxxxxxxx xxxxxxxxxx which stops people taking screenshots.
      Step 3. You can take your digital camera to take a snapshot of the image.
      Step 4. Somebody thinks up a way of xxxxxxxx xxxxxxxxx into images which xxx xxxxxxx by a digital cameras and stops them taking pictures.
      Step 5. People start using film cameras again.
      Step 6. What is so interesting in the picture in the first place?
      Step 7. Get a life.
      Step 0. Not too be to harsh, the plug-in would stop casual copying.

    24. Re:Debunked by netsharc · · Score: 1

      Actually it's PrtScr. And No need to hold Ctrl in Windows to do it. Although in Windows, holding Alt allows you to capture the current active window.

      --
      What time is it/will be over there? Check with my iPhone app!
    25. Re:Debunked by Anonymous Coward · · Score: 0

      The decryption key is stored server side (as clearly stated in TFS) so the client can't chose to just ignore the expiration date. Every time you view the image you have to request a decryption key from an XPire server, after the expiration date it will stop giving out the keys. Not claiming it's foolproof, or even a good idea, but your ranting and raving when you have no fucking clue what you're talking about is growing tiresome.

    26. Re:Debunked by vlueboy · · Score: 4, Interesting

      We would need to wait till HTML5 is here; its built-in magic might suffice to implement a viewer. But then how do they inject that code into facebook so that nobody has to grab the viewer on their own?

      Their Auto-tagger scans faces and asks users for the names of every face it has already framed in your pictures, and FB also does resizing and thumbnailing that clearly know when picture data is *not* what they're parsing after the upload. Facebook also isn't going to let you upload something that's clearly a noisy and corrupted JPEG file.

      They already changed their uploader so it compresses your images before they go out, and all I need is a slashdotter with an FB account to confirm that they can't even start to upload a binary disguised as a JPEG.

    27. Re:Debunked by IICV · · Score: 1

      Because if Facebook added that service, this third-party wouldn't be able to tell which pictures you're looking at. I mean, did you think they wouldn't keep track of which IP addresses and which browsers request which image keys?

    28. Re:Debunked by Anonymous Coward · · Score: 1

      Very right you are. Image informatics is progressing at a fast rate, add that to the fact that it can be used to enrich the data informatic businesses of the world. If you don't think there are a couple of very large companies downloading "everything" on the internet and linking it in creative ways to any other data source, be it paper or electronic, for resale to financial and law institutes, you are deluded.
       
      Slightly off topic and not meaning to Google bash, but it is in the same vein. Google is just the one of the tips of this iceberg, what they have done with Picasa is amazing. They convenienced a huge number of people to upload what normally would have been private(ish) pictures to them and tag names to the point they have gotten surprisingly good at automatically matching people in pictures to the correct name or if they are possibly related. I almost expect them to give away the Chrome netbooks for free just so they can get an even larger install base to harvest data from. I don't expect they'd resell the data. Simply having access to the treasure trove of user data, which will no doubt also contain pictures and tons of meta data, will do wonders to advance their image pattern matching algorithms, to name just one priceless benefit.

    29. Re:Debunked by osgeek · · Score: 1

      I refuse to even click on a link to an article with that much derp in it.

      The funny thing is that the non-Slashdot crowd will think this is a great idea.

    30. Re:Debunked by Nethemas+the+Great · · Score: 1

      Oh come now. This college crew will make a mint off of the same fools that post such indiscretions. A monthly fee to access your images? Brilliant! I'm quite certain no authority will be given access to the keys either... feel free to post all manner of naughtiness!

      --
      Two of my imaginary friends reproduced once ... with negative results.
    31. Re:Debunked by Anonymous Coward · · Score: 0

      Dear X-Pire,

      If I can see the image, it's mine.

          Love,
          Anyone with a fancy print screen button

      P.S.
      Thank you for setting me up with an automated way to identify photos which may be usable for blackmail later.

    32. Re:Debunked by Zerth · · Score: 1

      Every time you view the image you have to request a decryption key from an XPire server, after the expiration date it will stop giving out the keys.

      No, only the first time you view the image. Then your hacked version of the plugin saves the key and publishes it to the "people have tried this before and failed" memorial server.

      Plus, odds are they've screwed up the method of encryption and someone will be able to use information like the layout of standard image file formats as cribs to brute-force decrypt the images.

      Unless, of course, they're using one-time pads, in which case they'll run out of bandwidth just as fast as if they were serving the images directly.

    33. Re:Debunked by Anonymous Coward · · Score: 0

      by scot4875

      ...
       

      --Jeremy

        Okay, that's it. You've slipped up for the last time. I've changed my phone number, deleted my slashdot account, and I'm moving to an unidentified wilderness next week. You'll never take me alive!

    34. Re:Debunked by phyrexianshaw.ca · · Score: 1

      Hey... 1995 called, it wants its browser plugins back.

      This, a million times over.

      people need to stop thinking of web apps in terms of "Internet explorer users". people FINALLY moved into the idea that you MIGHT have to support Firefox+IE, but need to stop thinking of the browser as a single platform.

    35. Re:Debunked by EdIII · · Score: 1

      As a thinking being I think it may have been a good idea for all those pictures of Britney Spears' diseased clam to have an expiration date. Or goatse... or..... shudder ...... two girls one cup.

    36. Re:Debunked by amw · · Score: 1

      people need to stop thinking of web apps in terms of "Internet explorer users".

      Oddly, I happened to RTFM before it even reached Slashdot; the plugin they've developed is Firefox-only. This doesn't mean it's not headed for the bad-ideas graveyard, though.

    37. Re:Debunked by c · · Score: 2

      This all seems like a lot of work to protect people too stupid to not upload pictures to the Internet that they think might cause them problems later...

      --
      Log in or piss off.
    38. Re:Debunked by Evro · · Score: 1

      This is what I assumed it was from the subject: after "X" days, the image would "expire" from the server. This encryption thing is asinine. Is every browser going to include support for this dumb scheme?

      --
      rooooar
    39. Re:Debunked by SeaFox · · Score: 1

      I should also add: why not just have a service to delete the image automatically from facebook after N days? Encryption is absolutely not needed here and achieves nothing.

      It probably gives them something they can file a patent for that doesn't have prior art existing as a chron job.

      What would make more sense is people deleting images off Facebook themselves after a few days of them being online so all their friends have a chance to see them, or not uploading potentially embarrassing photos to start with?

    40. Re:Debunked by Yaur · · Score: 1

      more likely than any of that... they go out of business, shut down their server and all of your images are gone forever.

    41. Re:Debunked by old+and+new+again · · Score: 1

      it is stupid, who hasnt heard of prtscr or apple+shift+3 (or 4 if you want the pic cropped already) seriously, if you can see it, you can save it

    42. Re:Debunked by Dunbal · · Score: 1

      If you don't see it, you don't belong here.

      --
      Seven puppies were harmed during the making of this post.
    43. Re:Debunked by Dunbal · · Score: 2

      But - guess what else the browser plugin will be doing...

      --
      Seven puppies were harmed during the making of this post.
    44. Re:Debunked by The+Archon+V2.0 · · Score: 1

      Let me get this: Step 0. Not too be to harsh, the plug-in would stop casual copying.

      It'll also stop casual viewing. I wouldn't install a plug in just to look at a picture, even if some "friend" (person who I haven't seen in 10 years) told me it was really funny lol rofl gotta see it.

    45. Re:Debunked by Archangel+Michael · · Score: 1

      Technological Nanny State is where someone else is responsible for your stupid decisions. This is brought to you by Trial Lawyers and other (D) party associates on the left, and Big Corps and other (R) party associates on the right.

      Nanny State is by trying to fix personal irresponsibility and stupidity through laws. You can't fix stupid.

      --
      Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
    46. Re:Debunked by CoolGopher · · Score: 1

      So they just "invented" a CGI script that essentially does:

      #!/bin/sh
      FILE="/path/to/sample.jpg"
      XPIRE="110130"
      NOW="$(date +%y%m%d)"
      [ "$NOW" -gte "$XPIRE" ] && { echo "HTTP/1.0 404 Not Found"; echo ""; exit 0 }

      echo "HTTP/1.0 200 OK"
      echo "Content-Type: image/jpeg"
      echo ""
      cat "$FILE"
      exit 0

      only with more junk and requiring a plugin on the client side? Genius!

      Note: This was totally dry-coded off the top of my head. Bugs and standards compliance failures likely. The whole idea didn't seem to warrant a proper implementation in the first place.

    47. Re:Debunked by Cosgrach · · Score: 1

      Perhaps not only should the idea itself be sent to the bad idea graveyard, but additionally include the people who thought it up, and then the people who thought that it was a good idea.

      --
      Why is it that most of the people that I encounter seem to have been shat from the Sphincter of Mediocrity?
    48. Re:Debunked by harlows_monkeys · · Score: 1

      That only works if the picture is in memory that is accessible to the print screen software. I believe there are tricks you can do with modern video cards to compose the outputs from the computer-generated images and the output of the hardware video decoder on the card. So suppose the plug-in turned the picture into a movie, and then used GPU-accelerated video playback to decode that movie and insert it into the video output. It would never be in the frame buffer (or whatever you kids nowadays call the memory that holds pixels that the computers gets to read and write), and so out of reach of the print screen program.

    49. Re:Debunked by Cederic · · Score: 1

      ..and yet, somehow, people manage to record movies and take still images from them.

      If it's displayed on my screen, I can capture it.

      (Of course, if you don't want me accessing your photos after a certain timeframe, then skip this software entirely and just post on Facebook. I'll never see them.)

    50. Re:Debunked by Anonymous Coward · · Score: 0

      Already debunked by German bloggers.

    51. Re:Debunked by SheeEttin · · Score: 2

      I just tried, and it worked. (Granted, it wasn't a very good test: I embedded your post, zipped, inside today's featured picture, with OutGuess, a JPEG steganography tool.)

      Unfortunately, due to that compression/resizing Facebook performs, the data did not survive (even with OutGuess' ECC option enabled and using Facebook's "download in high resolution" link).

    52. Re:Debunked by mysidia · · Score: 1

      Slashdot users debunk this scheme as stupid in 5... 4... 3...

      Cmd+Apple+Shift+3 / Cmd +Apple+Shift+4 / Alt+PrtScrn / PrtScrn / Evernote clip rectangle or Window / Screenshotting tool of choice.

      Alternatively... hook DVI out cable of computer to frame grabber... view image, push snapshot button.

      Alternatively.... reverse engineer plugin, develop new plugin that requests the key, saves the image, and uploads it to a competing "image server" where the image will never expire; optionally posts link in reply to anyone using the 'expiring images' service.

    53. Re:Debunked by Jim+Hall · · Score: 1

      I was going to mod you up, but you're already at +5. So I'll post instead.

      I've wanted (and suggested) a feature in Facebook for them to automatically delete my photos after X days. I do that anyway - my online photos are generally short-lived. For example, last weekend, I deleted our Christmas photos from Facebook. It's been a month, family and friends who wanted to see those photos have already looked at them by now.

      Anything you put on the web is effectively public. Encrypting photos so they are unreadable after X days? That's not going to work. You can already do privacy settings on Facebook to limit who sees your stuff, but ultimately it's better to just delete those photos after a while anyway, rather than risk leaving them up forever.

    54. Re:Debunked by Luke+has+no+name · · Score: 1

      So yeah, pretty stupid overall. This is another sad attempt at a form of DRM.

      This is another sad attempt at users having rights over their own content as they see fit.

      DRM is not evil. Some of its uses are pretty shitty when looked at from the perspective of historical use (free access to recording -> Per-use viewing fees). But if I can set up a way to manage digital content along with expirations, permissions, etc., then that would be great.

      The problem is that we geeks theorize quite accurately that DRM for media is pretty much useless. Once the content is unlocked, it can be copied, period.

    55. Re:Debunked by http · · Score: 4, Informative

      Even theoretical trust in Facebook is misplaced. Here's a piece of news that you may have forgotten in the multitude of fucked up things Facebook has done over the past few years:

      Deleted' images are never deleted.

      In my experience, they are de-linked, but remain at the exact same URL. Also, they remain there even though my account has been "closed" for almost two years. Personally tested with dozens of images.
      The fact is, "Deleting the image from Facebook is not done."

      --
      If opportunity came disguised as temptation, one knock would be enough.
      3^2 * 67^1 * 977^1
    56. Re:Debunked by kasperd · · Score: 1

      Oh yes, and your friends will not be able to see your pictures unless they download a plugin

      So, I guess without that plugin the browser will not recognize the file as a picture. But how about Facebook, why would they recognize the file as a picture? I guess Facebook does not handle pictures as binary blobs that remain completely unmodified from upload until they are sent to a browser. They already scale the pictures, and I am not even sure if you can get to see it in the original resolution.

      So I guess they would have to make something that will still look like a picture, and which they can decrypt after it has been scaled. If they designed an encryption with those properties, I guess it will turn out to be totally broken, and there will be an easy way to decrypt without the key.

      --

      Do you care about the security of your wireless mouse?
    57. Re:Debunked by vlueboy · · Score: 1

      Though steganography itself is different from full encryption, I got a big kick out of your putting my own post inside the malachite pic, plus being honest and informative: now I know about outguess.

      Kudos!

    58. Re:Debunked by vlueboy · · Score: 1

      It'll also stop casual viewing. I wouldn't install a plug in just to look at a picture, even if some "friend" (person who I haven't seen in 10 years) told me it [...] gotta see it.

      MS Silverlight plugin site:
        "You raaaaang, sir?"

      ;-)

    59. Re:Debunked by Pharmboy · · Score: 1

      It's a race they can't win. But it's cute to watch them scurry around and try.

      As soon as it is implemented, they get their check, they have already won. What is sure to expire quicker than anything would be the usefulness of this software, but it only has to look useful for long enough to get some fool to pay you for it. Preferably a great big fool with big ass pockets, like Facebook. "Why, for only 25 cents per user, you can have this new feature." 3. Profit.

      When if fails, blame "black hat hack0rz", or better yet, Wikileaks.

      --
      Tequila: It's not just for breakfast anymore!
    60. Re:Debunked by Anonymous Coward · · Score: 0

      There's no such thing as a "hardware overlay." It's just another frame buffer, backed by memory that can be accessed and copied.

    61. Re:Debunked by Maow · · Score: 1

      Unless the service is refreshing the image data every single day with a new key, in which case: (a) they will run out of bandwidth and CPU in a week, (b) they will hit facebook's limits very very soon, and (c) I still have copies of yesterday's encrypted data and yesterday's key.

      Valid points, but thinking out loud here: if they serve up the image with image-magick, they could re-encrypt on a daily or weekly basis and only store the keys, dates valid, and of course the original image.

      May have to customise image-magick with an encryption plugin.

      Over all ... yeah, no this seems dumb.

    62. Re:Debunked by Anonymous Coward · · Score: 0

      If you believe that Facebook is an evil conglomerate that exists solely to steal photos of you drunk for some nefarious purpose, then why exactly are you putting photos on Facebook in the first place? I mean, come on. If you don't trust the company, don't give them your information. Anything else is just stupid.

    63. Re:Debunked by Z34107 · · Score: 1

      I wanted to see your image, but didn't have a Facebook Gold account ;_;

      --
      DATABASE WOW WOW
    64. Re:Debunked by SheeEttin · · Score: 1

      Well, you specified "binary" in your post, so I started with /bin/echo, but that was too big, but the only good smaller files I could find were text, so I decided to just use your post as it was rather apropos. (And then I zipped it for the "binary" part.)

      Re OutGuess: It was actually the sixth steganography program I tried, and the only one I got working. I started by Googling "jpeg steganography" (I'm not familiar with any other way of embedding data in am image), which led me here, but all of the programs mentioned there were either gone or didn't compile, so I moved down in the results to OutGuess, which did work. (However, the command syntax is rather cryptic (ha): you use outguess -d DATA.BIN IN.JPG [OUT.JPG].)
      Don't go gettin' yourself on no watchlists, now. ;)

    65. Re:Debunked by Anonymous Coward · · Score: 0

      > its built-in magic might suffice to implement a viewer

      Err, there is no "built-in magic" in HTML5. There is a "video" tag, that works just like today's "img" tag in that it indicates to the browser the type of content to display.

    66. Re:Debunked by Phroggy · · Score: 1

      I heard somewhere (quite likely on Slashdot) that Facebook stores images in a custom filesystem (or something), heavily optimized for efficiency, and that because of the way the system works, it is not technically possible to delete a photo.

      (You could, in theory, overwrite the photo, but they don't do that. They can remove it from their index, however, which is as close to deleting it as they get.)

      --
      $x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
      $x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
    67. Re:Debunked by tehcyder · · Score: 1

      Bullshit, GP was just the knee jerk libertarian "government is evil" reaction to anything involving the diminution of absolute freedom, as though such a thing exists except in our own heads.

      --
      To have a right to do a thing is not at all the same as to be right in doing it
    68. Re:Debunked by tehcyder · · Score: 1

      ...in which case you just stick a digital camera in front of your monitor.

      --
      To have a right to do a thing is not at all the same as to be right in doing it
    69. Re:Debunked by tehcyder · · Score: 1

      Blah blah blah so health and safety rules, anti-child labour laws and the abolition of slavery are just Nanny Statism and should be abolished?

      --
      To have a right to do a thing is not at all the same as to be right in doing it
    70. Re:Debunked by Anonymous Coward · · Score: 0

      Screenshot!

    71. Re:Debunked by Anonymous Coward · · Score: 0

      Researchers have created - another wannabe PhD that just had to make up something to cover up his procrastionation?

    72. Re:Debunked by Anonymous Coward · · Score: 0

      ...if you trust Facebook.

      That would be your first mistake.

    73. Re:Debunked by JackOfAllGeeks · · Score: 1

      why not just have a service to delete the image automatically from facebook after N days?

      but ultimately it's better to just delete those photos after a while anyway, rather than risk leaving them up forever.

      You might as well propose a system to automatically delete trhem from the Internet, since that's what we're really talking about here.

      The problem, for lack of a better word, is that young people (here read as 13-30, but could be extended) tend to be risky and careless in what they do and what they post. This is most evident when they carelessly post evidence of someone else bering risky -- and you have the subject (or the subject's parents) getting upset that the photos show them in a bad light and could come back to haunt them after they grow up

      If it's on the nternet, it's public. And most likely it's been archived and copied all over the place. The "X-Pire" encyption scheme works for the most basic case where someone saves an actual copy of the encrypted photo, but not if the photo is saved unencrypted. As noted else where, once it's on the Internet, it's there forever. And once it's unencrypted, it's unencrypted forever.

      This is just another short-sighted, ineffective attempt to put the proverbial genie back in the bottle. It fails to recognize how the Internet works.

    74. Re:Debunked by JackOfAllGeeks · · Score: 1

      Your inherent assumption is that the major concern is stuff that someone posts themselves. You're missing the more pervasive problem of what other people might post about you. It doesn't matter how discerning you are about what you post because you can not stop other people. And it doesn't matter how careful you are living your life, either; there is always something that can be interpreted or misconstrued by someone to put you in a bad light.

      The only difference is that now it's all stored on an infinite, searchable medium that won't go away, and people are looking for ways to deal with that.

    75. Re:Debunked by RockDoctor · · Score: 1

      So yeah, pretty stupid overall. This is another sad attempt at a form of DRM.

      The only way that I'd disagree with you is that, from the summary, this is an easily-broken form of DRM which seems to have been designed for purposes that wouldn't cause the developers sleepless nights. It's doomed to failure in multiple ways (didn't I mention yEnc in my very last posting on SlashDot? I think I did.), but I don't think it actually qualifies as evil.

      --
      Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
    76. Re:Debunked by RockDoctor · · Score: 1

      to protect people too stupid to not upload pictures to the Internet that they think might cause them problems later...

      Several relevant quotes from an SF author : "not responsible for advice not taken" ; "stupidity has always carried the death penalty" ; "just think of it as evolution in action".

      --
      Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
    77. Re:Debunked by Archangel+Michael · · Score: 1

      Exploitation is not caused by "stupid" it is caused by evil. Know the difference. If stupid was illegal, I'd lock you up for not knowing the difference.

      --
      Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
    78. Re:Debunked by Anonymous Coward · · Score: 0

      Alternatively, all I have to do is comment on your post of the image with the key I just downloaded for it while it was still valid. Even more alternatively, I could set up a counter-service to this that stores retrieved keys permanently and hands them out publicly. Unless the service is refreshing the image data every single day with a new key, in which case: (a) they will run out of bandwidth and CPU in a week, (b) they will hit facebook's limits very very soon, and (c) I still have copies of yesterday's encrypted data and yesterday's key.

      I'm assuming all that will be overcome by the use of a one-time key. Specifically, each time the image was viewed a one-time key would be used to re-encrypt the file, so the same key would not be useful for two different people (or specifically two different downloads). Of course, you can still just saved the encrypted file and the one-time key, which will be handily stored in your local cache.
      But you can also not bother with that and just save the image after it's been viewed in the first place.

      My prediction: This will go over exactly as well as encrypted email has gone over, for all the same reasons (and more).

    79. Re:Debunked by kaizendojo · · Score: 1

      Best counterpoint so far; you raise a good angle.

    80. Re:Debunked by KarlMalden · · Score: 1

      In the year twooooo-tousand:

      - ****** releases a new version of ***** plug-in supporting the encrypted .jpgx format with time expiration field. Plug-in rolls out an automatic update...
      - A new form of dyslexia is identified by researchers where sufferers can't distinguish and misuse words too & to...

      ;-(

    81. Re:Debunked by nspyraishn · · Score: 1

      Slashdot users debunk this scheme as stupid in 5... 4... 3...

      X-Pire= DRM for images. And I thought Facebook's control over *my* content was bad enough...and the memory-hogging addon was already the deal-breaker to begin with...

  2. Until... by MrOctogon · · Score: 5, Insightful

    Cue the plugin which takes a screen capture of the decrypted image and re posts it in its original form. If you can read it you can copy it forever.

    1. Re:Until... by Pinback · · Score: 2

      Time for an army of people with screwdrivers to rove the world and steal all the Prnt Scrn keys?

    2. Re:Until... by betterunixthanunix · · Score: 1

      That would be true if this were a DRM system, that is, if your adversary were the people you are sharing the image with. The point of the system is to ensure that people who carelessly leave images online will not have to worry about some random future employer stumbling across an embarrassing picture years later -- the service will (presumably) stop giving out the decryption key after the expiration date.

      Of course, this turns the service into a trusted third party, and I strongly doubt that the keys will actually be deleted from their database; more likely, the keys will be kept just in case law enforcement asks for them. It is not a perfect system, it is just meant to chip away at the problem.

      --
      Palm trees and 8
    3. Re:Until... by Anonymous Coward · · Score: 0

      And it also helps people monetize images by offering an enforcable (but circumventable) micro-payment scheme. All these stock image sites will be able to charge per thousand viewers. It'll increase the cost of running websites which gets passed on to end users. They also get the hassle of a DRM-encrusted format that requires a net connection to 'authenticate'.

    4. Re:Until... by dgatwood · · Score: 4, Insightful

      More to the point, it can be solved just as easily if Facebook would:

      • Require users to accept or reject tagging explicitly before a photo tag becomes visible to anyone other than the tagger and the taggee.
      • Expire photos after a reasonable period of time unless the user explicitly confirms that it should remain posted (use notifications).
      • Expire tags in the same fashion.

      More importantly, it fails because:

      • The sorts of people who post pictures of their friends looking like assholes are unlikely to care enough to use a special service that provides expiration.
      • The sorts of people who post pictures of their friends looking like assholes are unlikely to set a short expiration date.
      • The person affected by the tagging is not the person deciding on its expiration.

      The decision about how long I should be tagged in a photo must be my decision, not the decision of the person who posts the photo. Any scheme that does not achieve this goal is completely missing the point.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    5. Re:Until... by poetmatt · · Score: 1

      that may be the point, but the reality is that it doesn't' work.

    6. Re:Until... by MrOctogon · · Score: 2

      I think I remember a system that relied on distributed hash tables to accomplish pretty mush the same thing. That will at least remove the central trusted authority problem, but opens itself to a whole other class of attacks as well.

    7. Re:Until... by Dishevel · · Score: 1

      Why do we need to chip away at this problem. As an employer I would not judge a person as unreliable because they posted pics of them doing beer bongs at 22. I would though judge them to be not the brightest of applicants. It is good to know.

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    8. Re:Until... by Dishevel · · Score: 2

      1. Those are not your friends.
      2. You make bad decisions. (This is based on your choice of "Friends" not the image itself.)

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    9. Re:Until... by Anonymous Coward · · Score: 1

      More to the point, it can be solved just as easily if Facebook would...

      While what you're saying is all logical, you seem to be operating under the delusion that Facebook gives half a shit about your privacy. Hint: they don't. Therefore, any solution to this problem must come from outside of Facebook.

    10. Re:Until... by betterunixthanunix · · Score: 5, Insightful

      Why would you claim someone is not the brightest of applicants, just because they partied when they were in college? That is exactly the sort of attitude that created this problem in the first place: employers who have this notion that anyone who doesn't conform to the ideal defined by US government propaganda is somehow less desirable. Why does it matter to you that an applicant to whatever sort of job you might employ them for smoked pot when they were in college? Why would you go digging through someone's Facebook profile to find evidence of what sort of partying they did in college?

      --
      Palm trees and 8
    11. Re:Until... by metrometro · · Score: 4, Insightful

      I think this misses the point somewhat. Don't we all hate DRM because those schemes are a real bitch for data portability and long term archives? Which is it, then?

      The reason you put a timed kill switch on an archive is not because people in the present will use it in ways you dislike -- if that were true, why create or share it at all? The point is rather to piss off and disrupt the people in the far future who are post-facto digging through archives on you. Internet research hinges on how easy it is to find things. This would probably make it harder to find things that have expired.

      Security exists in an ecosystem. Everything can be broken. But the only questions that matters is will it actually happen most of the time?

    12. Re:Until... by Dishevel · · Score: 1
      Let me make my point clearer for the simple people.

      Like I made "Not clear enough for you" in my previous post. I would not judge him because I knew that he was drinking irresponsibly, or smoking a joint. I would judge him on the stupidity of his choices to post these behaviors to the internet with no thought whatsoever.
      Like those who permanently mark themselves in areas hard to hide with temporary thoughts and beliefs. I do not think that tattoos or drinking are reasons to judge the young.
      Though if you put a tattoo on your forehead that said "Party till you Puke!" or posted pics of you being drunk and mooning nuns on Facebook I would and will believe you to be a person who can not think beyond what you want at the moment. And. I will be right.

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    13. Re:Until... by Dunbal · · Score: 1

      On the other hand it's his business and he can hire who he wants. Right or wrong doesn't matter because at the end of the day, it's his dime. Over time he will reap the benefits or suffer the consequences of his decisions - regardless of what your "opinion" is.

      --
      Seven puppies were harmed during the making of this post.
    14. Re:Until... by Anonymous Coward · · Score: 0

      There's a big difference between partying in college and putting up pictures of yourself partying in college. It's the latter who aren't the brightest of applicants. You might not like the system, but it's there or we wouldn't be discussing the issue. Since it can hold you back from a job, you're dumb if you post those photos. And it's not whether you or I think it's silly to be finding old photos of people. As long as some (many?) employers do it, it's something to be concerned about.

    15. Re:Until... by Anonymous Coward · · Score: 0

      I would judge him on the stupidity of his choices to post these behaviors to the internet with no thought whatsoever.

      Perhaps they suspected that if employers were intelligent they wouldn't judge them based on this and shrugged it off?

    16. Re:Until... by Cederic · · Score: 1

      I would judge him on the stupidity of his choices to post these behaviors to the internet with no thought whatsoever.

      There are embarrassing photos of me on Facebook. They're tagged with my real name. They're visible to potential employers.

      Nothing I do in them is illegal, nothing I do in them impacts my ability to do my job, some of them are indeed from my student days.

      I don't have a Facebook account.

      Tell me, exactly, what the stupid choice I've made here is, that would prejudice you against giving me a job?

      Hint: I'd turn it down anyway; I don't work for fucking idiots.

    17. Re:Until... by Lehk228 · · Score: 1

      seems like a browser plugin that logs in to your facebook and deletes all images in a certain folder periodically would be better, easier, more secure, and entirely user-side

      --
      Snowden and Manning are heroes.
    18. Re:Until... by treeves · · Score: 1

      Ha ha. I don't use the PrtSc key. I use Cropper.

      --
      ...the future crusty old bastards are already drinking the Kool-Aid.
    19. Re:Until... by Anonymous Coward · · Score: 0

      Neither smoking nor getting drunk are illegal, but as an employer I see them as indicating that the candidate lacks the self-discipline to even look after their health.

      If that's how they treat their body, how much worse will they treat their workplace?

    20. Re:Until... by Dr_Terminus · · Score: 1

      Ah, so you use the Cropper for your caper to keep the capture of Claude Coopers clean copper clappers he kept in a closet?

    21. Re:Until... by dfenstrate · · Score: 1

      Why would you claim someone is not the brightest of applicants, just because they partied when they were in college? That is exactly the sort of attitude that created this problem in the first place: employers who have this notion that anyone who doesn't conform to the ideal defined by US government propaganda is somehow less desirable. Why does it matter to you that an applicant to whatever sort of job you might employ them for smoked pot when they were in college? Why would you go digging through someone's Facebook profile to find evidence of what sort of partying they did in college?

      Your basic premise is that doing stupid stuff in college shouldn't prevent you from getting a good job, and I agree with that.

      However, posting images of various wild or illegal activities in college could be seen as lacking good judgment and discretion, which are separate aspects from 'bright' (or raw intelligence), but every bit as important. If not moreso.

      So I'm saying that young people should avoid posting images of illegal or wild adventures, not because those activities should bar them from employment, but because posting those images shows indiscretion and a lack of foresight that goes beyond the act in question. Those images could reflect badly on you, so you shouldn't post them. If you did post them, you're a dumbass.

      Yes, the reasoning is a little recursive. The potential employee will need to bend themselves, to a certain extent, to the way the world is, not the way it ideally should be.

      Being 'bright' isn't enough. I'm one of the most intelligent people I know, and I've figured out that raw intelligence alone counts for little.

      --
      Alcohol, Tobacco and Firearms should be the name of a store, not a government agency.
    22. Re:Until... by Dishevel · · Score: 1
      You are so right. Why should I hire an employee based on their ability to hold back and think before they act.

      That is so old fashioned of me. Thank God there was an AC here to set me straight.

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    23. Re:Until... by Dishevel · · Score: 1
      I see that you make bad choices in those you surround yourself with.

      You realize that judging a person by the company that they keep is valid?

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    24. Re:Until... by Anonymous Coward · · Score: 0

      Sometimes it's the partying you did in college that actually helps your career. Just ask former Australian Prime Minister, Bob Hawke:

      "His academic achievements were complemented by setting a new world speed record for beer drinking: a yard glass (approximately 3 imperial pints or 1.7 litres) in eleven seconds.[13] In his memoirs, Hawke suggested that this single feat may have contributed to his political success more than any other, by endearing him to a voting population with a strong beer culture.[12]"

      http://en.wikipedia.org/wiki/Bob_hawke

    25. Re:Until... by Cederic · · Score: 1

      So... I go to a party, hosted by friends (one's a lawyer, one owns a software company). It's fancy dress.

      You're telling me I make bad choices because I hang out with people that like fancy dress parties and facebook?

      You are indeed an idiot.

    26. Re:Until... by Cederic · · Score: 1

      wtf? You refuse to employ people that drink alcohol or smoke?

      I'd be in big trouble. I engage in physical sports. I mean, forget temporary mild intoxication, I've broken legs!

      You'd have to avoid me in case I broke your whole office! I mean, I could burn it down or ram a truck into it or anything!!

      Or you could just be an idiot.

    27. Re:Until... by Dishevel · · Score: 1
      A lawyer and and a software company owner posted and tagged pics of you doing stupid shit on Facebook?

      You choose to call these people your friends? I am the idiot?

      Interesting thought processes you have going on there.

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    28. Re:Until... by Cederic · · Score: 1

      Friends of them used a media sharing site to share media with their friends of a harmless and fun activity that I happened to be engaged in.

      Yes, you are the idiot.

      Why are you so defensive about this? What's the issue here? I'm genuinely confused, surely it's pretty obvious that people have a professional life and a private life, and they'll get up to things in their private life that don't impact them professionally but that other people that know them can and do know about?

      Why the automatic assumption that anybody that doesn't live an isolated staid existence is inherently and immediately making bad choices?

    29. Re:Until... by Dishevel · · Score: 1

      Why the automatic assumption that anybody that doesn't live an isolated staid existence is inherently and immediately making bad choices?

      I don't. I only think you make bad choices if I can see you make bad choices.If I can see you make bad choices I get to judge you on those choices. The excuse that well I did not put them online my friend did holds no water with me. Bad friends are a choice as well. After that is pointed out I get "Well a friend of a coworkers cousins buddy put them online" line. Make sure that you take no responsibility for anything in your life.

      Can I judge you for the positions you take in this conversation? Can I take from the lengths you are willing to go to to show how you can not possibly be faulted for the outcome that you have some practice doing that in your professional life as well? I did.

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    30. Re:Until... by Cederic · · Score: 1

      You haven't seen me make any bad choices. You don't know who I am, you haven't seen any photos, you just know that I've spotted your irrational prejudice.

      Personally I'm quite comfortable with the photos, I'm not ashamed of my extra-curricular activities and I've worn fancy dress to work before for charity.

      You're still an idiot.

    31. Re:Until... by Dishevel · · Score: 1

      If you are embarrassed by your choice to wear "fancy dress". Then yes. You are an idiot. Good luck with your life.

      --
      Why is it so hard to only have politicians for a few years, then have them go away?
    32. Re:Until... by Geminii · · Score: 1

      I bet most of the current US political structure partied while they were in college. Perhaps a little less partying and a little more studying might lead to a bit more genuine leadership.

  3. Goes Nowhere by Anonymous Coward · · Score: 0

    And no one will use it cause most people are to stupid to be able to install a plugin.

    1. Re:Goes Nowhere by SlashDotDotDot · · Score: 1
      No one will use it because:

      A. The people posting the pictures don't care (at least at the time they are posting them)
      B. Facebook doesn't want it to work and they have the power to stop it by not allowing encrypted pictures. (If they wanted this feature, they would just provide it themselves by removing the content on a given date.)
      C. Even if posters cared enough to use this system, no one would be able to see their pictures because

      most people are to stupid to be able to install a plugin

      and posters want people to see their pictures (which is why they are posting them online)
      D. It is too easy to circumvent

      --
      /...
    2. Re:Goes Nowhere by Anonymous Coward · · Score: 0

      And no one will use it cause most people are to stupid to be able to install a plugin.

      I don't think you're in a position too say that anyone is to stupid.

    3. Re:Goes Nowhere by madprof · · Score: 1

      Is "to stupid" a verb? If so, I can barely imagine what sort of action it might entail. Stabbing yourself in the head with a pitchfork? Injecting yourself with bleach?

      You could have some grammatical fun with it though...
      "Let me say now your instructions are to stupid. Those are instructions that must be followed"

    4. Re:Goes Nowhere by Anonymous Coward · · Score: 0

      You forgot E

      E) Facebook doesn't want your random binary blob uploaded as a "picture" on their website, because then they couldn't check whether it violates their terms of service.

  4. Print Screen by Anonymous Coward · · Score: 1

    Now your expiration date doesn't matter.

  5. Cracked! by clvrmonkey · · Score: 4, Insightful

    I can't quite figure out how they'll stop me from taking a screenshot of the encrypted image.

    --
    All God does is watch us and kill us when we get boring. We must never, ever be boring.
    1. Re:Cracked! by I8TheWorm · · Score: 1

      This is the internet where the honor system reigns supreme!

      I kind of like it here in the tubes, and I think I'll stay a while.

      --
      Saying Android is a family of phones is akin to saying Linux is a family of PCs.
    2. Re:Cracked! by Tenek · · Score: 4, Insightful
      That's not the point. You were already allowed to see the image. What it tries to reduce is the ability of someone unrelated to find it n years later. You had to remember to save a copy at the time. Unfortunately, you're probably more likely to do so if it's an interesting picture.

      It's not useless, and it's not perfect. Not a terrible idea though.

    3. Re:Cracked! by mcmonkey · · Score: 1

      It's not useless, and it's not perfect. Not a terrible idea though.

      It is a terrible idea.

      Here's the need: I'm in college. I post crazy college pics for my friends to see while I'm in college. Next year, when I'm graduated and interviewing for jobs, I don't want those pictures available.

      Here's the solution:
      Make the pics private. Make them only available to friends on facebook. Or use some other hosting service with password protection.

      Or even easier--rather than have a service host the keys and promise to destroy the key when you want the image to expire, why not just host the pics with a service that promises to destroy the pics when they expire?

      It's terrible because it's needlessly complex.

      I could come up with a scheme for car registrations where a code is affixed to the license plate. Then traffic police can access a data-driven 3-tier client-server web 2.0 interactive site where they can look up the code and see if that car's registration is current.

      We'll even provide scanners with OCR to read the license plate and look up the code.

      Or the state can send out stickers with the registration year, people put the stickers on their plates, and cops just read the stickers.

      I won't dismiss the technology completely. There may be some use for the system.

      But in this case, instead of encrypting the pics and storing the decryption key for a limited time and requiring the use of a plug in, why not just host the pics for a limited time, no plug in required?

    4. Re:Cracked! by johneee · · Score: 1

      On windows I know it can happen. I remember some kind of 'secure' image thing a long time ago ('97?) that could only be viewed inside a plug in, and if you tried to do a print screen, you just got an empty box. I don't know how of course, because even at the time I didn't care enough.

      Perhaps something through Direct3D, since I know you can't do a screen capture of that kind of stuff.

      Anyway, probaby still easy to circumvent, but not necessarily by print screen.

      --
      - ------- There are ten kinds of people in the world. Those who understand binary, and those who... Huh?
    5. Re:Cracked! by Rude+Turnip · · Score: 1

      "Here's the need: I'm in college. I post crazy college pics for my friends to see while I'm in college. Next year, when I'm graduated and interviewing for jobs, I don't want those pictures available.
      Here's the solution:
      Make the pics private. Make them only available to friends on facebook."

      This idea fails so hard it's not even funny. The solution is to never post anything online that you would never want anyone to see in the future. Your friends aren't that important that you need to impress them. Theoretically, if they are true friends, you should feel secure in leaving those pictures there. However, by virtue of your desire to take those pictures offline after college, you have exposed your distrust in your friends. Believe me, if you post up anything there that is worth saving, they will simply drag the image into the pictures folder on their hard drive.

    6. Re:Cracked! by Obfuscant · · Score: 2
      I can't quite figure out how they'll stop me from taking a screenshot of the encrypted image.

      One of the satellite photo systems prior to googleEarth wanted to keep their images controlled and did something similar to this. You had to have their plugin to see the images and you had to run javascript to load them, and the javascript did something to disable the print-screen button -- on windows -- and the "save image" option. As I recall, the plugin didn't work on unix/linux so they were protected there.

      Unless, of course, you were VNCing into a windows box from a Linux box, and then xwd was quite able to dump the window contents.

    7. Re:Cracked! by Jason+Levine · · Score: 1

      If we're not counting a Print Screen or some kind of exported copy as a crack then a much simpler solution would be for Facebook to include a "Expire Image On" feature. Leave the date blank and the image stays forever (or until Facebook is shut down, whichever comes first). But enter a date there and, once that date is reached, the image would be no longer accessible.

      Like the X-Pire service, this would be vulnerable to a Print Screen or some other export system. However, an Expire Image On feature wouldn't require DRM or the installation of a plug-in to work.

      --
      My sci-fi novel, Ghost Thief, is now available from Amazon.com.
    8. Re:Cracked! by rpresser · · Score: 1

      You have failed to understand him. He DOES trust his friends with the pictures. He wants to prevent his FUTURE EMPLOYER from seeing them. Therefore he makes the pictures available only to his friends, not to everyone on Facebook. XPire Not Required.

    9. Re:Cracked! by icebraining · · Score: 1

      Theoretically, if they are true friends, you should feel secure in leaving those pictures there. However, by virtue of your desire to take those pictures offline after college, you have exposed your distrust in your friends.

      No, I think the suggestion was posting it as public when in college, and making it for his friends only after graduating. Your friends always have access to them.

    10. Re:Cracked! by Cederic · · Score: 1

      The solution is to never post anything online that you would never want anyone to see in the future.

      .. and the solution for photographs that other people post?

      Not that your point isn't valid in context, just that the proposed photo aging approach only addressed the 'shoot yourself in the foot' issue, not the 'other people are twats that like to post photos' issue.

    11. Re:Cracked! by Anonymous Coward · · Score: 0

      I can't quite figure out how they'll stop me from taking a screenshot of the encrypted image.

      Obviously they'll put a javascript alert on the PrintScrn key.

    12. Re:Cracked! by soonerthanuthink · · Score: 1

      "What it tries to reduce is the ability of someone unrelated to find it n years later."

      What it would actually do is reduce the ability of an unrelated individual without cash in hand to find it n years later. A plugin like this would create several new businesses involving the archiving of images posted to social networking sites. Those images would eventually be available to employers for a small fee.

      So you really haven't protected the privacy of users... if anything you've diminished it by creating the illusion of privacy, enticing them to post stuff which they wouldn't have otherwise posted, which will be used against them later if they ever want to have a real job, or go into politics, etc.

    13. Re:Cracked! by Rude+Turnip · · Score: 1

      ".. and the solution for photographs that other people post?"

      Boo-hoo. You don't have the right to act like a twat in public.

    14. Re:Cracked! by greed · · Score: 1

      Ahh, that takes me back.

      When I had to do some documents on the local setup for a couple of change control programs, I did all my Windows 2000 screenshots by VNCing to the Windows machine and using 'xv' on Linux. Not only did that result in reasonable file formats (rather than BMP), but I could happily crop the result before saving.

      Windows users probably have a Better Way, but I'm not a Windows user.

    15. Re:Cracked! by Cederic · · Score: 1

      It's acting like a twat to attend a public art event where everyone dresses to match the theme of the event, to politely interact and make it fun and to go home with the friends I attended with afterwards?

      Those photos are on the 'net. They are definitely not ones I'd share with a potential employer. Shit, I have 5 1/4 inch heels on in them..

  6. crap by z-j-y · · Score: 1

    this thing takes 18 month?

    and this crap is so retarded and useless it's not worthy of any discussion. dump it directly into toilet!

    your government scientists hard at work.

    1. Re:crap by HarrySquatter · · Score: 1

      Yeah, exactly what took 18 months to develop a system that encrypts a picture and sends out encryption keys upon request? That sounds like something that could be set up in a matter of weeks at most.

    2. Re:crap by skids · · Score: 1

      Well, maybe you and I could, but you're not a "researcher" now are you? So what good would it be?

      Seriously, does the "researcher" job come with a pay raise? If so how does one become a "researcher" so that any random coding/QA stint counts as "research" and is thus both news and (probably) patent worthy?

    3. Re:crap by countSudoku() · · Score: 1

      HEY, that research grant money is for actual research, not for taking pictures of your friend smoking a bong with their anus and trying to hide it later. Thorough research takes lots of time, even though this could have been implemented in a week or so. At that pace the grant money would dry up. Like with IT budgets; you HAVE to spend every cent, and spending less means you get less money the next cycle.

      --
      This is the NSA, we're gonna geet U h@x0r5! Also, what is a h@x0r5?
  7. alt-prtscn by Anonymous Coward · · Score: 3, Funny

    your feeble encryption is no match for my clipboard.

    1. Re:alt-prtscn by BobMcD · · Score: 1

      your feeble encryption is no match for my clipboard.

      I came to post the exact same thing.

      Further, why take the photo at all if you're not going to keep it for more than a limited time?

    2. Re:alt-prtscn by igreaterthanu · · Score: 1

      It's easy enough to create a loop that checks if the content of the clipboard changes and if so detect if it is a screenshot of the "protected" image and if so change the clipboard to be storing something else.

      Obviously there are other methods that anyone on here could think of but this is facebook we are talking about. I'm not sure some of these people even know what printscreen does.

      --
      I dream of a nation where a man is not judged by his skin color but by an number assigned by a credit rating agency.
    3. Re:alt-prtscn by h4rr4r · · Score: 1

      My print screen goes right to a file.

    4. Re:alt-prtscn by natehoy · · Score: 1

      My web browser doesn't have access to my clipboard to make changes like that. Yours does? Get that changed. NOW. That there's a mind-bogglingly huge security hole, right there, that most products (even IE) fixed back when we didn't have a "2" as the first digit of our 4-digit year.

      --
      "This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
    5. Re:alt-prtscn by igreaterthanu · · Score: 1

      This is a browser plugin, not javascript. It runs with the same privileges as Flash.

      --
      I dream of a nation where a man is not judged by his skin color but by an number assigned by a credit rating agency.
    6. Re:alt-prtscn by Anonymous Coward · · Score: 0

      Take a picture of the screen with a camera. Problem solved.

    7. Re:alt-prtscn by Anonymous Coward · · Score: 0

      It's also not that difficult to run Windows in a VM, and do whatever screen capture you want in the host OS.

    8. Re:alt-prtscn by Anonymous Coward · · Score: 0

      Actually, it's not possible to grab the contents of the clipboard from the browser without resorting to flash or java. Security and all that.

  8. no pictures for linux users... by dmbasso · · Score: 5, Insightful

    because you can't lock the print screen out, right?

    --
    `echo $[0x853204FA81]|tr 0-9 ionbsdeaml`@gmail.com
    1. Re:no pictures for linux users... by Anonymous Coward · · Score: 0

      With this scheme, the print screen key becomes an illegal circumvention device via the DMCA.

    2. Re:no pictures for linux users... by dudeman500 · · Score: 1

      what has been seen cannot be unseen...

    3. Re:no pictures for linux users... by dmbasso · · Score: 1

      Oh come on, goatse was not that bad, go watch "A Serbian Film" :)

      --
      `echo $[0x853204FA81]|tr 0-9 ionbsdeaml`@gmail.com
    4. Re:no pictures for linux users... by Anonymous Coward · · Score: 0

      Even if you could, I could then take a picture of the screen with my phone

  9. Hmm... by Tenek · · Score: 1

    Sounds great, but the more interesting/risky/incriminating/etc the picture, the more likely it is that someone's going to keep an unencrypted copy around, no?

    1. Re:Hmm... by betterunixthanunix · · Score: 1

      The real question is, are your friends conniving enough to save embarrassing photos of you on their hard drive, just in case someone years later wants to see it? Employers are not browsing your friends' hard drives; they are, however, browsing your Facebook profile, and they may see all the partying you did in college (or whatever). You may not remember that the pictures are there, especially if you have lots and lots of pictures; your future employer should not stumble across evidence of some long-forgotten party.

      Of course, your friends might still post pictures on their own profiles, without encryption. The system is far from perfect.

      --
      Palm trees and 8
    2. Re:Hmm... by MoonBuggy · · Score: 1

      Of course, in an ideal, or even slightly less idiotic world, the employers might realise that everybody parties and that old picture of a prospective employee doing shots while wearing a toga in no way alters their ability to do the job now.

    3. Re:Hmm... by PFI_Optix · · Score: 1

      A simple screen shot means that the picture itself can go viral, even if the person's name is lost in the process. The internet has been kind enough to let most of these people remain anonymous so far. We don't care about the names of drunken college girls, we just like to laugh at and/or ogle them.

      If you have the presence of mind to know that you don't want a future employer seeing the picture, you have the presence of mind not to post it, right? So long as things like this are optional (and they damn well better remain so) they will remain unused by the very people who they would benefit: the stupid.

      --
      120 characters for a sig? That's bloody useless.
    4. Re:Hmm... by hitmark · · Score: 2

      If the employer is that anal about off hours activities, it may well be better to not work there in the first place.

      --
      comment first, facts later. http://chem.tufts.edu/AnswersInScience/RelativityofWrong.htm
    5. Re:Hmm... by betterunixthanunix · · Score: 3, Interesting

      Of course, we have plenty of anti-drug propaganda to keep us far from the ideal. A picture of someone taking a bong hit at a party could be reason to be rejected from a job -- there are still places that perform pre-employment drug screenings, last I checked, and photographic evidence of illegal drug use may not go over so well. When we keep telling people that anyone who uses illegal drugs is an unreliable drug abuser who couldn't possibly hold a job, and when we require people to maintain a "drug free workplace" or forfeit government contracts, the idea that employers will forgive some college partying seems a bit far fetched.

      --
      Palm trees and 8
    6. Re:Hmm... by Anonymous Coward · · Score: 0

      If you have the presence of mind to know that you don't want a future employer seeing the picture, you have the presence of mind not to post it, right?

      It's not that simple, though. You may have the presence of mind not to post a picture, but you can't stop someone else from taking a picture of you partying and then posting it and tagging it with your name.

    7. Re:Hmm... by sconeu · · Score: 1

      Hey it ain't an illegal drug, it's Salvia!

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
    8. Re:Hmm... by phyrexianshaw.ca · · Score: 1

      This!

      I've worked for a number of people in my life: and I've told the ones who would reject an employee based on their youth that happen to be available on the internet to go fuck themselves.

      I'm happy to take a pay cut if it'll change somebodies bad habits. I'm sick and tired of the constant attempts to prevent kids from having fun. Just because you never got to go to parties and get drunk with friends is not a valid reason to not hire people that did.

    9. Re:Hmm... by phyrexianshaw.ca · · Score: 1

      Please, somebody with mod points push this guy up.

    10. Re:Hmm... by PFI_Optix · · Score: 1

      But you have no control over whether that is encrypted or not, as it's their picture.

      --
      120 characters for a sig? That's bloody useless.
    11. Re:Hmm... by hawguy · · Score: 1

      I'm happy to take a pay cut if it'll change somebodies bad habits

      Well except that it won't change anyone's habits -- I'm more likely to hire (or pay more for) the guy that doesn't have pictures on his FB profile showing him doing a kegstand. The guy who does have that picture on his profile shows a distinct lack of judgement and I probably don't want to rely on him.

      As an employer, I feel that you're free to do what you like in private, just show a little discretion in a public forum. I don't want to see pictures online of you drunk and naked at our company christmas party someday.

    12. Re:Hmm... by Cederic · · Score: 1

      As an employer, I feel that you're free to do what you like in private, just show a little discretion in a public forum.

      As an employer it's fuck all to do with you if your employee likes cottaging, dogging or other public activities in which you personally prefer not to partake.

      Why should sharing photographs be any different?

      There's video footage of me engaging in one of my hobbies on Youtube. Why is that any more socially acceptable than a student engaging in a perfectly normal student hobby?

      Discretion matters if it's secretive stuff. When it's things that are in the public domain anyway then why hide it? Maybe you're ashamed of your student days but I know I'm not. I also wont tolerate people being twats towards other people that went out and had fun.

    13. Re:Hmm... by Lehk228 · · Score: 1

      you can set facebook to not allow others to see what you are tagged in.

      --
      Snowden and Manning are heroes.
    14. Re:Hmm... by hawguy · · Score: 1

      There's video footage of me engaging in one of my hobbies on Youtube. Why is that any more socially acceptable than a student engaging in a perfectly normal student hobby?

      You haven't said what your hobby is and what this perfectly normal college activity is. If your hobby is carving wood with a chainsaw, I'd see you as an artistically talented individual. If your hobby is getting sloppy drunk and vomiting in your girlfriend's lap (which I, regrettably, did in college, but the photos are not online), then I'd be less than impressed.

      Discretion matters if it's secretive stuff. When it's things that are in the public domain anyway then why hide it? Maybe you're ashamed of your student days but I know I'm not.

      As an employer, it's the Discretion that I'm most concerned with. I don't really care if a potential employee engages in cottaging in his spare time. However if he shows such poor discretion that he posts a video of his Cottaging activities online in a public forum, that's where I become concerned.

      My problem is not with the activity, it is with the apparent lack of discretion that he showed by posting it online.

      I don't care if there's a picture of him at a party with a beer in his hand. But if there's picture of someone holding up his legs to do a keg stand, then again, I question his discretion in a business environment. I don't work in a particularly conservative industry but rather than take the risk that his public persona will offend some future client, I'll give preference to the other candidate (who may have very well done the same activities, but showed enough discretion to not post the pics for all to see).

      And of course, I hope that you sense this disapproval when you're interviewing and decide that you don't want to work here - I'm sure there are plenty of places to work that will value you and embrace your public cottaging activities.

  10. Interesting, but implementation is false by grasshoppa · · Score: 1

    Don't make clients install a plugin. The client is in an unknown state, and most people will just ignore it anyway.

    Instead, target the individual companies ( like facebook, google, shutterfly, ect... ) with this technology.

    --
    Mod me down with all of your hatred and your journey towards the dark side will be complete!
    1. Re:Interesting, but implementation is false by houghi · · Score: 1

      Those companies are in the business of keeping and selling data and now you ask them to trow away their assets?

      --
      Don't fight for your country, if your country does not fight for you.
    2. Re:Interesting, but implementation is false by Anonymous Coward · · Score: 0

      and then what ? they (fb,google etc) will never show the image ? You can't make copies of images off FB.com ? how will this work ? (Hint: It wont....)

    3. Re:Interesting, but implementation is false by Kjella · · Score: 1

      Instead, target the individual companies ( like facebook, google, shutterfly, ect... ) with this technology.

      Except they don't need this silly thing to have an expiration date, they could simply remove the picture. The theory here is that anyone who saves the image will save their encrypted format instead of a normal JPG. The outcome is as expected, people that think they've "backed up" their files from Facebook will lose their pictures and anyone that really wants a copy will take a screenshot and save as PNG. It's like a lock that inconveniences the residents but doesn't keep a single crook out, I'm sure this will fly like a dodo with cement shoes.

      --
      Live today, because you never know what tomorrow brings
    4. Re:Interesting, but implementation is false by grasshoppa · · Score: 1

      Sure, but that's assuming customers trusted the companies in question to do so.

      The reason you might focus on these larger enterprise type organizations is to allow them the opportunity to create value for their product ( read: "Customer" ).

      The customer trusts this 3rd party to handle the encryption/decryption/expiration, not the company holding their data.

      It's convoluted, sure, but it's more viable than expecting end users to install plugins just to view images.

      --
      Mod me down with all of your hatred and your journey towards the dark side will be complete!
  11. read by Anonymous Coward · · Score: 0

    if you can read it you can copy it, if you can copy it you are creating a new version with your own options.....

    assume here you are encypting images and creating a 'new' file and whether or not you can read it is totally in the hands of X-Pire software, assuming the company doesn't muck it all up due to incompetence the problem is it introduces 'hassle' and people are lazy.

  12. I wish Facebook would expire by PatPending · · Score: 5, Insightful

    I wish Facebook would expire... the sooner, the better.

    --
    What one fool can do, another can. (Ancient Simian Proverb)
    1. Re:I wish Facebook would expire by Anonymous Coward · · Score: 5, Funny

      Anonymous Coward likes this

    2. Re:I wish Facebook would expire by Anonymous Coward · · Score: 0

      Anonymous Coward likes this

      my favorite comment in a long time!

    3. Re:I wish Facebook would expire by countSudoku() · · Score: 1

      Mod this up and consider it "Prior Art!" +1 I think MySpace would also like to subscribe to your newsletter! :)

      --
      This is the NSA, we're gonna geet U h@x0r5! Also, what is a h@x0r5?
    4. Re:I wish Facebook would expire by wondafucka · · Score: 1

      I wish Facebook would expire... the sooner, the better.

      What's the matter? Did an army of 14-year old girls subvert your internet?

    5. Re:I wish Facebook would expire by Anonymous Coward · · Score: 0

      Why? Don't use it. And don't give me shit about people being able to put up photos of you, they can do that on photobucket too. And the whole "BUT THEY CAN TAGG MEEE" doesn't matter as there's no way to search for photos by your name unless you have an account, even if you're tagged.
      So it doesn't affect you, hating new trends whether or not justified doesn't make you sound smart.

    6. Re:I wish Facebook would expire by Anonymous Coward · · Score: 0

      Not gonna happen. As long as people are vain and stupid, Facebook will continue to enjoy mass appeal.

    7. Re:I wish Facebook would expire by Anonymous Coward · · Score: 0

      Anonymous Coward likes this

      my favorite comment in a long time!

      Hey, stop replying to myself... wait... uh oh...

  13. LAME!!! by mschaffer · · Score: 1

    OMG, I just don't know where to start with how lame this is.

  14. You are being shortsighted by lvangool · · Score: 1

    It's all about 'unfortunate' stuff that keeps on strolling around the interweb 15 years later. It's about careers and marriages. Of course it will not prevent anyone from saving the images and keeping them for future reference, but how do you decide now who will be the president in 2030? This could prevent a lot of shame because we won't value a shameful picture of someone who has yet to become famous.

    1. Re:You are being shortsighted by O'Nazareth · · Score: 2

      We will just get used to this. One day, we will have to accept that nobody is perfect anyway.

    2. Re:You are being shortsighted by Anonymous Coward · · Score: 0

      Or... you can just not upload potentially "shameful" pictures of yourself to the internet in the first place. And if it's your friends doing the uploading of your likeness that can have such future, damning effects, perhaps a change in company is in order...

    3. Re:You are being shortsighted by natehoy · · Score: 1

      And you think someone in 2030 won't be able to break 2010 encryption with their pocketknife?

      If the image is out there, it's viewable. After it expires, unless you remove it from the web site it's on, it's still viewable and with very little effort. If you've removed it from the web site it's on, then expiring it has no value.

      MPAA can't keep an encryption scheme secure for more than a month, what chance do you think a browser plugin will have after 15 months? 15 years? C'mon, there'll be an tool akin to DeCSS for it in a week.

      --
      "This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
    4. Re:You are being shortsighted by PFI_Optix · · Score: 1

      Yes, because our society seems to be placing LESS value on embarrassing celebrities or looking perfect.

      --
      120 characters for a sig? That's bloody useless.
    5. Re:You are being shortsighted by Skidborg · · Score: 1

      You could just act like a really upstanding person and not engage in activities that you might get in trouble for later. But of course, nobody is going to do that.

      --
      Supporter of the +1 Over Dramatic mod option. In memory of apk.
    6. Re:You are being shortsighted by Thiez · · Score: 1

      > And you think someone in 2030 won't be able to break 2010 encryption with their pocketknife?

      That is exactly what I think. The encryption schemes that get broken all the time are usually DRM schemes which are defective by design, because the client must have access to the key to access to content, and must have access to the unencrypted content to view it. But encryption algorithms in general are quite good, and brute forcing the solution usually takes more time than the lifetime of the universe, or more energy than is available in the visible universe, or some combination thereof. 20 years advancement in hardware is not going to change that. Unless some serious flaw is found in an encryption algorithm, your amazing encryption-breaking pocket knife will be very disappointing.

      You may find this http://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html an interesting read.

    7. Re:You are being shortsighted by Anonymous Coward · · Score: 0

      I keep a copy of updates and pictures of everyone that I have access to. Especially the private stuff.

      With storage so cheap, I'm sure I'm not the only one.

      The only way to win is not to play.

    8. Re:You are being shortsighted by lvangool · · Score: 1

      Is there software to do that?

  15. won't work. by phillipsjk256 · · Score: 1

    Anti-copying mechanisms only work in soft science fiction like Star Trek (Transporters have strong anti-copy technology, as do the holodecks).

    If the legions on Slashdot can support or disprove that claim, you would be doing me a favour.

    Hint: We already know it doesn't work in the "real world" : http://craphound.com/msftdrm.txt

  16. More great science/tech reporting. . . by JSBiff · · Score: 2

    "tagging" something with an "encryption key" is something which doesn't make a lot of sense. I guess maybe someone would want to search for the file based on the key it was encrypted with? *grin*

    You know an article is quality when stupid crap like that shows up in the very first paragraph. Who do these big media outlets hire to do their sci/tech articles anyhow? Apparently people who haven't got the faintest clue how things work, or how to explain to others how they work. Somehow, they seem to consistently find the absolutely *least qualified* people to write such articles.

  17. X-Pire-copy-to-imgur browser add-on by seifried · · Score: 4, Insightful

    Which will result in something like the "X-Pire-copy-to-imgur browser add-on" which automatically decrypts the image and then posts a decrypted copy to imgur or whatever sharing site you want to use.

    Not to mention all the large companies trolling facebook for photos and storing them for later use to provide background check style services/etc.

    Once you post it, a copy has been made, once someone views it, a copy has been made. Those copies are outside your control. Even if you encrypt it, once someone views it, an unencrypted copy has been made, and it's once more out of your control.

    1. Re:X-Pire-copy-to-imgur browser add-on by neoform · · Score: 1

      CMD-SHIFT-4 *yoink*

      --
      MABASPLOOM!
  18. Sadly, it's a total waste of time by bogaboga · · Score: 1

    ...researchers have created software that gives images an expiration date by tagging them with an encrypted key so that once this date has passed the key stops the images being viewed and copied.

    How long shell we wait before some fella creates a tool that copies those photos, backs them up somewhere after removing the so called encryption?

    If they doubt this is possible, they need not look very far. The RIAA knows a thing or two about this.

  19. This will fail... by Anonymous Coward · · Score: 0

    Apart from the fact that this software only provides a technically ridiculous protection, this will fail in the exact same way that most encryption system fail: the users don't care enough. That's the reason why the mainstream has not adopted email encryption and encryption of instant messages. Encrypting instant messages is trivially easy, yet I couldn't even get many IT people to do it. The users won't install any browser add-on just to view the encrypted pictures of other people. And because everyone knows that, nobody will encrypt their pictures in the first place.

  20. long past shelf date by Anonymous Coward · · Score: 0

    does this mean that 40 y.o. can no longer use their yearbook photos? Will it be like drivers licenses and passports, requiring new photos every few years? That's great for dating sites but who cares about facebook photos?

  21. Flaw #2 by kenj0418 · · Score: 1

    Flaw #1 that seems to be the focus so far is that you can capture the screen image an make an unencrypted copy. This will only prevent copying by unsophisticated users. (But isn't that exactly who it is for?)

    Flaw #2 concerns me more. It is (one of) the same problem(s) as with most DRM - what happens when this key server goes poof? Now all your images are unreadable.

    1. Re:Flaw #2 by geekoid · · Score: 1

      1) It's to remove them from specific facebook users. You know, the 18 year old dumb ass that is now out of college and looking for a job? WHen he is 18 it didn't amtter,m now it does. So looking for a Job interview and those pictures are gone when the potential employer is doing 'research'

      2) Yes, thats a problem, but you could beuild this into facebook as a feature.

      Idea? good.
      implementation? bad

      --
      The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
    2. Re:Flaw #2 by coolmadsi · · Score: 1

      Flaw #2 concerns me more. It is (one of) the same problem(s) as with most DRM - what happens when this key server goes poof? Now all your images are unreadable.

      So long as they hang around for more than a few months, that's not a flaw, its a feature!

      I can't see it being that much of a problem, it just means its not available online, assuming the user has the original (or a back up) on their computer/phone/etc. so can be re-uploaded if necessary. And if they don't have a back up, worse that will happen is their picture gets removed from internet viewing a bit earlier than they expected, but they were planning on having it removed anyway

    3. Re:Flaw #2 by Anonymous Coward · · Score: 0

      So... what makes you think that when he was 18, if he was stupid enough to post embarrassing pics, that he was "smart" enough to encrypt them with something that expires them by the time he's older and job hunting?

      Idea? bad.
      Implementation? bad.

    4. Re:Flaw #2 by Anonymous Coward · · Score: 0

      1) You know what? It matters ALWAYS. When he's 18, it matters.
      Remember all those threats to put something in your "permanent record"?
      Kids today are dumb enough to actually do that to themselves, unprompted.
      The way to solve this? Teach them just how stupid it is. And if they don't learn that lesson? Then they end up at the bottom of the labor pool.

      2) And nothing of value was lost. They're flippin' facebook pictures. The world is better off without them.

    5. Re:Flaw #2 by Anonymous Coward · · Score: 0

      Flaw #3
      When someone cracks the encryption all the images can be viewed regardless of the 'expiration' status.

  22. Screenshot by ninjagecko · · Score: 1

    Screenshot. That is all.

  23. Just another means of tracking... by HeadSoft · · Score: 1

    One can imagine it enables them to track who is viewing the image anytime, whether or not it's served from Facebook.

    It seems everyone wants to call themselves a "researcher" these days, as if there is science behind what they do. The truth is, it's just another hustle.

  24. New Business Ideas by andymadigan · · Score: 1

    New Business Model:

    Crawl facebook and other sites which use this technology, grab and decrypt all such images, save them and sell a subscription to them.

    Second Business Model:

    Sell a hacked version of the plugin which allows you to save the image easily.

    Hey, a good percentage of the public seems to think that DRM works, it's no wonder they keep coming up with stupid ideas like this....

    --
    The right to protest the State is more sacred than the State.
  25. Not a bad idea, but probably won't work anyways by Yossarian45793 · · Score: 1

    For those complaining about the technical aspects of this proposal, obviously anyone who views the image before the expiration date can save it forever. The point is that after the expiration date, no new people can download the image if they haven't already. Think about your potential employer downloading drunken pictures of your from a frat party 10 years ago. This scheme would prevent that.

    Now the fact that this requires a 3rd party plugin to work is problematic. It creates a bottleneck, an extra point of failure, and it suffers from the chicken and egg problem -- nobody will want to post x-pire pictures if their friends can't view them without a plugin, and nobody will install the plugin because they don't need it to see the other 99% of pictures people post.

    1. Re:Not a bad idea, but probably won't work anyways by Anonymous Coward · · Score: 0

      Think about your potential employer downloading drunken pictures of your from a frat party 10 years ago. This scheme would prevent that.

      No, it would not prevent that, just like simply deleting the picture would not prevent that. In fact, since the key is much smaller, it is much easier to make a shadow library of keys than to make a copy of all pictures. This technology could only serve as a how-not-to.

    2. Re:Not a bad idea, but probably won't work anyways by Anonymous Coward · · Score: 0

      ok but there is no reasons to encrypt the image at all.

      1. A users who has the plugin and is within the permissable time window can just view it and save it. They will always have access.
      1.a So the document does not really expire for them any who has it has it forever.

      2. The time window is passed, so a user can no longer get the encryption key. Ok fine but simply having removed the image after the expiry date would do the same thing. The way to solve this *need* is for facebook to simply let a user set an expiry date on images and purge them after that date. If FB won't do it the set up a script tied to a local database of the users images and their expiry times could.

      ENCRYPTION IS TOTALY POINTLESS HERE!

    3. Re:Not a bad idea, but probably won't work anyways by Anonymous Coward · · Score: 0

      The point is that after the expiration date, no new people can download the image if they haven't already.

      Why doesn't facebook just let you set a Date when posts expire? When the post expires then Facebook deletes the post. I'm not sure how a deleted image protects your privacy.

      [IMAGE EXPIRED]
      Caption: Dude...you are so wasted from all that pot we smoked.

  26. i see the benifit by bitappend · · Score: 1

    sure some small percentage will find away around a few photos they want cracked.. this will still block out the majority of pics out there. i think this is a good idea of putting some kind of control back to the person who made the pics.. even if its not 100% fool proof. This is low level protection like a lock on your front door. there will always be ways around it. but it does add "some" level of protection as long as you understand it as such.

  27. At least the plugin is free by __aaqvdr516 · · Score: 1

    Because you know....I install every free plugin that I come across just to view pictures and stuff.

  28. LOL LOL by Maxo-Texas · · Score: 1

    Okay... because i can never hit the print screen key or take a picture of whats on the screen with my camera and repost it.

    --
    She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
  29. ummm..rm? by Mr.+Slippery · · Score: 1

    So let's see...to implement image expiration on my website, I can ask all my members to install your plugin...or I can add

    system("at now + 78 weeks /bin/rm /var/www/photos/embarrassing_photo.jpg");

    to my image upload module. Gee, which way should I go?

    --
    Tom Swiss | the infamous tms | my blog
    You cannot wash away blood with blood
    1. Re:ummm..rm? by betterunixthanunix · · Score: 1

      Not your website that you need to worry about; the plugin targets Facebook/MySpace/etc., where a lot of people are posting embarrassing pictures of their late teenage years which may resurface when they are looking for a job. The whole point is that those websites do not have any option for expiring images.

      --
      Palm trees and 8
  30. Discontinuation by O'Nazareth · · Score: 1

    I can bet the service will be discontinued before any picture will achieve the expiration date.

  31. *facepalm* by TheSpoom · · Score: 3, Insightful

    *facepalm*

    This whole concept should be on The Daily WTF.

    --
    It's better to vote for what you want and not get it than to vote for what you don't want and get it.
    - E. Debs
    1. Re:*facepalm* by 68kmac · · Score: 1

      All of Germany (or at least those that understand how a computer works) has been facepalming over this since it was introduced (article is in German) 10 days ago.

      What's worse: It was lauded by our minister of consumer protection as an example of German innovation. How embarrassing. Government-sponsored publicity for something that even the inventor admits won't stop anyone from taking a screenshot. Geeks in Germany have been taking the system apart over the last couple of days. There's already a hack that circumvents the Firefox plugin.

  32. Needless DRM. Expire things server-side. by Khopesh · · Score: 1

    This is just another form of DRM. Instead of keying on payments, it is based on a date, but the premise is the same; it is an unnecessary locking of a file which is trivially defeated (worst case scenario: take a screenshot!) and therefore not worth the annoyance. How about just adding the expiration date to the EXIF (or other meta-) data in existing media formats? Any site (specifically Facebook, MySpace, etc) would then be able to revoke the media based on the expiration date. Adding an expiration field to the submission process would do the same thing. Look ma, no end-user annoyances!

    As to emails and other similar avenues, live and learn (and use better judgment in picking your friends!). DRM isn't going to stop the issue; it might even exacerbate it ("oh, this image is set to expire. I'd better save an unprotected copy and use it as blackmail later.")

    --
    Use my userscript to add story images to Slashdot. There's no going back.
  33. Or, you know by geekoid · · Score: 1

    Just tag an expiration date when you upload the photo, and have a default date.

    --
    The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
  34. Color me amazed! by Anonymous Coward · · Score: 0

    This is almost as brilliant as those scripts people used to use to block right clicks!

  35. Then You by mistralol · · Score: 1

    right click and save as .jpg :)

  36. And like every other facebook App, it will by Anonymous Coward · · Score: 0

    Expose all your facebook data to the App owner along with the picture. Sounds like data mining exploit by Facebook on Facebook users.
    Problem, no nitch market exists for picture data which users believe they own even after uploading to Face book.
    Facebook by making a 3rd party app viewer to view pictures will give its self an out when the data is used by the 3rd party nefariously.
    By encapsulating the view into an App, they can under the guise of supporting the app do data mining and sales on all related data.
    Profit!

    Most importantly Facebook will use the 3rd party to shift blame to for all the nefarious data mining apps not hosted on face book but that use the data.

    So now when you walk into Wal-Mart the advertisements will say "Hi Malcopt, your friend Bagwhore bought product x every week for the last x weeks. You should try it.
    Doesn't everyone have a face book friend named bagwhore?
    Or on the TV in Wal-Mart, Hi Joe, get your facebook friends to by Laser shark meat and you all will get a 20% discount coupon on all Wal-Mart family friendly Goatsie products.

  37. Un-X-Pire by cforciea · · Score: 4, Insightful

    I'm ready to start a new service called Un-X-Pire. What you will do is run my browser add-on, which will find X-Pire tagged images, request the decryption key from the X-Pire service, and then cache it the first time it is requested for each image. After that, it will just serve out the decryption key over and over (or, if the decryption does something fancy like swap keys based on current time, it will go ahead and decrypt the image for you by spoofing the time the key was initially first cached as the current system time for the decryption process), and then everybody who uses my plug-in will be able to view the image for the rest of eternity so long as at least one person views it with my plugin before it expires.

    Also, I bet mine takes a lot less time to code than theirs.

    1. Re:Un-X-Pire by Khalil+Fazal · · Score: 1

      So the only thing you are caching is the key (for other users) and not the entire image, correct?

    2. Re:Un-X-Pire by cforciea · · Score: 1

      That depends. If X-Pire works as described in TFA, then yes, because the only thing their server is described as doing is passing out the same keys I would be. If X-Pire actually causes the image to be encrypted with different keys depending on either time or originating IP or something like that, then you have to actually cache the image. No matter what they do, though, there has to be a way for me to uniquely identify the image they need decrypted, so the caching will only happen once.

    3. Re:Un-X-Pire by Anonymous Coward · · Score: 0

      I suggest you name this concept X-Tender or X-Tension.

    4. Re:Un-X-Pire by Anonymous Coward · · Score: 0

      PRTSCR here, X-Pire is faget!!1

  38. Consider the scope. by Anonymous Coward · · Score: 0

    This is not meant to be a foolproof method of preventing people from seeing photos you don't want them to see. This is simply a method of preventing images that you once wanted people to see from hanging around after you've thought the better of your original decision. Sure, someone could capture and re-post the photo in unprotected format if they act before the expiration date, but the point is not to stop others from doing bad deeds.

    I don't know about this approach in particular, but the concept seems like a killer app for social networking sites that want to assuage user concerns about their youthful indescretions following them around indefinitely.

  39. the fbi will have the unlock key and will be able by Joe+The+Dragon · · Score: 1

    the fbi will have the unlock key and will be able to bypass this.

  40. Oh great, embarrass us internationally... by Anonymous Coward · · Score: 0

    This "technology" has been touted by Ilse Aigner, the Federal Minister of Food, Agriculture and Consumer Protection. According to Wikipedia, "Aigner completed a professional training as a telecommunications technician in 1985 and joined the electrical installation business of her parents. In 1990 she graduated from the technical academy with the degree of a State Certified Engineer and worked for several years for Eurocopter in the development of helicopter electric systems." She thinks this nonsense is going to make Germany lead the world in online privacy protection... It is beyond embarrassing. I am sorry and apologize for these idiots.

  41. Well this is certainly going to be adopted... by goldcd · · Score: 2

    If Facebook actually wanted pictures to have a shelf-life, they could just allow you to add a default date+x when they would be pulled.
    Facebook haven't done this, so I'm guessing they're either a bit short of development cash - or don't want this.

    So, how might this work?
    Well I'm guessing that either it's:
    a brand new file format and the browser requests an external key when the photo display plugin kicks in - so so unlikely to take off, I'll just leave it there.
    OR
    it's encrypts the image and embeds in tags so the 'plugin' can detect it's a 'special image' and goes off to find a key to decrypt it.
    Assuming it's the second, it has my interest. Sounds a little bit interesting - but then I start thinking.
    If it's encrypted it's going to have 'look random' - so that's ballsed up the compression ratios of the jpg you uploaded.. and then well most sites tend to compress/thumbnail/crop or a combination of the above... well I don't quite see that working - no it couldn't
    I guess maybe we're onto option C, I've just thought of. You don't upload the image, you upload a QR style pointer to the image - and the browser just inserts that in-line?
    Well, maybe that would work.. but then these researchers just seem to have come up with a way of replacing an <img src= with a graphical pointer..
    Oh and as everybody else has undoubtedly posted whilst I typed this, printsrn.

    Maybe there's a market somewhere for pushing the whole public key encryption seamlessly into "stuff we upload" - to restrict or monitor view - but the problem that's never going to go away is that if one person can open it and wants to share it, then there's no security.

    1. Re:Well this is certainly going to be adopted... by swilver · · Score: 1

      If it's encrypted it's going to have 'look random' - so that's ballsed up the compression ratios of the jpg you uploaded

      There's two ways to do the encryption. But the only one that makes sense is to FIRST compress the image (with JPEG), then encrypt it. I don't see how it would have the slightest impact on compression ratios.

      Of course, schemes have been known to first encrypt data, then try to compress it, but I doubt they would ever become very popular.

  42. 18 months, seriously? by dingen · · Score: 2

    development work began about 18 months ago

    18 months to build this seems an awful lot, doesn't it? Ubuntu has released 3 versions in such a period!

    --
    Pretty good is actually pretty bad.
    1. Re:18 months, seriously? by Anonymous Coward · · Score: 0

      I suspect the tricky bit was making the images compatible with the automated mangling of photos that are uploaded to it.

  43. What a great idea... by Anonymous Coward · · Score: 0

    Now we can scan for the tasty stuff.

    Cool.

  44. I have a better idea by kheldan · · Score: 2

    Here's a better idea that won't require any additional plugins or new technology to be created: Don't upload pics to Facebook or any other so-called "social networking" site that you don't want available to the public forever. We'll call this idea "common sense".

    --
    Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
    1. Re:I have a better idea by Anonymous Coward · · Score: 0

      well, actually, MY common sense says to upload that picture of you fucking that whale last night is a pretty good idea. Oh and if you think i'll use xpire or some other way of setting an expiration date, you're wrong. Its on break, facebook, myspace , twitter, flickr and slashdot by now =)

      hah, common sense

    2. Re:I have a better idea by Anonymous Coward · · Score: 0

      Um, how many times does it have to be explained on this site that Facebook allows and even encourages people to upload and tag pictures of their friends/relatives/acquaintances/classmates.... My Facebook profile lists 40 pictures of me. Guess how many of those I uploaded myself? Five. The rest were uploaded by a friend of a friend who likes to take pictures.

      But thank you for your terse, unhelpful advise. Say, I wonder if you could help me with a few Linux questions. Just kidding.

    3. Re:I have a better idea by kheldan · · Score: 1

      ..because Facebook has proven itself to be so fucking trustworthy with their users' personal data and privacy, we should just continue to put our entire lives on there and other sites like it and ignore the possible consequences. Over and over again I hear from the uninformed, "I have nothing to hide!". So you and everyone else, please, just go on ahead and keep doing what you're doing. I'll be over here not having my entire life be a matter of public record. Enjoy not getting that great job you wanted, because your prospective employer doesn't like the photo your buddy took of you in the karaoke bar when you had had one drink too many -- regardless of the fact that it was your birthday, you never drink like that, really, it was just a one-time thing!
      ..oh, and regarding those of you who are going to be so quick to point out that our lives are already a matter of public record: Bullshit, they are not, not until we wake up one morning and find CCTV cameras in every room of our houses. Those of us who actually value and protect our private lives still have one.

      --
      Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
    4. Re:I have a better idea by Geminii · · Score: 1

      Don't digitise the photos in the first place, someone else might upload them.

      Wait, don't take the photos in the first place, someone else might scan them.

      Wait, you're not the only person at that party with a camera...

  45. Not totally worthless by Anonymous Coward · · Score: 0

    I get that most people here are saying this is totally worthless, and you would be right if there was a reason to break this encryption en-mass. What I think this does help prevent is people you don't know at a time in your past, getting pictures from a time before they knew you.

    Basically, it is not cost effective for Facebook to decrypt all these photos, thus on that database your pictures will degrade. Now, during the given time-frame, anyone can decrypt, and some will, but you are implicitly allowing that. What you are implicitly disallowing is Facebook et al. keeping your data forever.

    Naturally all this is predicated on the 'fact' that it is not cost effective for the central database to comb itself for these self-deprecating bits of data and decrypt them all periodically/upon upload.

  46. Print screen by NeumannCons · · Score: 1

    I agree that there are a lot of reasons why this is unlikely to more forward.

    From a technical standpoint though, in Windows, you can make a plug-in that will prevent "print screen" from working on/"seeing" certain areas of the screen. Fire up Windows Media player. Start any movie, hit print screen and then see what you got by pasting it into something. You'll notice you'll get the media player window with a nice black box for the content. I also remember Windows being able to do that with IE when they first started their Terraserver project - the imagery was somehow copyrighted and you could look at it, but attempting to copy it or print it resulted in an image with the word copyright repeated over and over and no satellite image.

    Of course this won't prevent anyone determined enough to reverse engineer the way the plugin works and then design a workaround. It would however prevent the casual user (probably about 99% of the facebook population) from simply using print-screen or copying the image and mailing it to a friend.

  47. Solution to the wrong problem. by Restil · · Score: 1

    The problem isn't that people need a way to clear embarrassing information off of the internet, the problem is that they put it up there in the first place. From the time the kindergartener learns his first dirty word and proceeds to tell it to as many people as he possibly can, he will (hopefully) get chastised severely in short order, and learn, from that experience and many more, that there are certain things you simply don't do in polite society if you want to be treated kindly by those you care about. Almost everybody knows exactly where that line is drawn or can find it reasonably easily. Most people that choose to cross it do so knowing full well the potential ways in which it can backfire. If people choose to ignore that good advice and label themselves to be impetuous and vulgar, and show no responsibility for their actions or their future, then that's their business, and we should LET THEM. While not everything I've ever written or posted has been of the highest caliber, I'm not worried about anyone holding any of it against me either. But that's just me. Everyone makes their choices. If you want to be a douche, go ahead. That's your business. You'll be judged accordingly.

    -Restil

    --
    Play with my webcams and lights here
  48. That's right up there with.. by GrBear · · Score: 1

    That's right up there with 'How do I stop the email I sent 5 minutes ago?'.

    People (unwashed masses) don't take the time to think about the consequences of exposing themselves on the Internet.. let alone the privacy implications.

    Herd mentality at it's finest... Mooo!

  49. Why? by Anonymous Coward · · Score: 0

    Just how much effort are you willing to expend to circumvent your friend's desire to keep his or her trivial snapshots trivial?

  50. Unless police subpoena it at a later date... by KreAture · · Score: 1

    Seriously, what is to stop the keys from being available forever regardless of what date you set? I also agree with those hitting screen-dump right about now. Once decrypted, always decrypted.

  51. I see a completely different problem with this by Opportunist · · Score: 1

    Think that the average FB User is not really the most technical or even security conscious person. He will hear "FB now keeps your pictures from circulating". And their reaction will probably be "Ok, then I can upload that pic that I didn't dare to because someone might download it. Now they can't download it and if someone gets it that shouldn't, I'll just retract it".

    I foresee a lot of interesting fallout from this. Hopefully enough to get people aware of the privacy threat FB is.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  52. NEWS! Slashdot Title Wrong by KnownIssues · · Score: 5, Insightful

    I am kind of used to Slashdot headlines that exaggerate the original article, but how do you go from a company has made some software that might be useful to social networks *like* Facebook to Facebook is going to get images with expiration dates?

    1. Re:NEWS! Slashdot Title Wrong by Anonymous Coward · · Score: 0

      Oh look it's "timothy".

  53. facebook? by Anonymous Coward · · Score: 0

    where the fuck is facebook mentioned in anything in the TFA ?

  54. Why a screenshot? by AlienIntelligence · · Score: 1

    Why is everyone saying screenshot?

    Once the image is on your screen, it's decrypted... it's yours,
    it's in the cache, it's on your harddrive. Not only that, if your
    cache is persistent, and you have a super long expiration
    on it, it'll be on your drive for X months which may end up
    being Their Date+X = new expiration. Oh, that person just
    got elected? Hmm, I looked at their profile 4 months ago,
    let me rummage in my cache.

    Does the wayback hold facebook info?

    Can't someone just write some script to copy all available
    images off of Facebook while they are still up and just put
    them on a drive somewhere? I know pron-heads have been
    doing that for a while, lol.

    X-pire's website is broken, if you look at the link that is
    supposed to explain it, when you scroll the text, you can't
    read it, lol. Lemme check another browser... nope just broken
    in IE8, Chrome works fine. Hmmm, almost forgot why I quit
    using IE, haha.

    So, I looked at their site...
    1) price has already gone up.
    2) only works (viewing) on Firefox cause of the extension
    3) only works on jpg
    4) specifically states it doesn't prevent copying before expiration
    5) W00t! you can add a captcha for "added protection", shame
    captcha's been broken.

    from website:
    If the images are viewed using a browser in which X-pire! is not installed or using another software for viewing images, only a black and white image is shown with a text indicating where X-pire! can be downloaded (free of charge for solely viewing these images). The image remains protected.

    Protected? Is the text everywhere? Humans can't see in
    black and white? If it's past expiration is the image still
    visible in black and white with text on it? Or does it show
    expired?

    I'm sure Facebook will be happy with all of these images
    showing expired. Isn't that 'one' of the things that made
    MySpace so ugly, all those 'hosted' images suddenly
    expiring or going over their quota then you have some
    horribly offensive (white) box in place of the image.

    Only real huge benefit I see, I read on their site that you
    can hit a panic button and exire ALL of your images at
    the same time, instantly. That, I kinda like.

    Can't wait to see it implemented! (So I can take bets how
    long before it's fully defeated and useless)

    -AI

    --
    For me, it is far better to grasp the Universe as it really is than to persist in delusion
  55. Two real solutions ... by perpenso · · Score: 2

    (1) Have facebook support user defined expiration dates.
    (2) Have facebook allow a user to subcategorize friends, subcategories would just be a configuration item not a publicly displayed state. Perhaps family, friends and coworkers. You can then tag photos to be only shown to particular subcategories.

    1. Re:Two real solutions ... by tm2b · · Score: 1

      Um, this might be a "whoosh," but you can already do #2. And set default permissions for all your postings.

      My biggest gripe is that you can't alter the permissions of an item after you post it.

      --
      "It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
    2. Re:Two real solutions ... by perpenso · · Score: 1

      "Woosh"? Maybe, but are you referring to shared groups? If so then it seems people know how they are characterized. I'm suggesting something where your "facebook friend" does not know how they have been categorized.

    3. Re:Two real solutions ... by Anonymous Coward · · Score: 0

      Facebook currently implements option 2. Now of course you have to decide to trust that they won't arbitrarily reorganize their databases in such a way as to open your pictures back up to everyone.

    4. Re:Two real solutions ... by Strange+Ranger · · Score: 1

      If so then it seems people know how they are characterized.

      Really? This is terrible. Can you tell me how I can see how my friends categorize me? I looked but can't figure it out.
      I have a business presence on FB and need to fix this if it's true.
      I guess I could use code names for the groups "buddies" "pals" "Friends Group 1" etc. to mean different things. But that's a pain. Can you verify your assertion? Much appreciated!

      --

      Operator, give me the number for 911!
    5. Re:Two real solutions ... by tm2b · · Score: 1

      Are you sure about that? I haven't seen an interface for that, I have been using it for a year or two.

      --
      "It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
    6. Re:Two real solutions ... by tm2b · · Score: 1

      Oh, if you are talking about the "groups" that you "join," no, that is not it.

      I am talking about "lists" of "friends.". You can name them and use them as part of permissions to posted items, and AFAIK, there is no way for another user to know what lists of mine that they are on.

      --
      "It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
    7. Re:Two real solutions ... by Anonymous Coward · · Score: 0

      Soln 2 has already been possible for a long time, just that 90+% of users don't know/bother to use it.

    8. Re:Two real solutions ... by perpenso · · Score: 1

      Thank you. Lists sound like what I was looking for. I'll go through the fb ui and settings again.

    9. Re:Two real solutions ... by cyclomedia · · Score: 1

      (3) Have people in society stop acting weird about the fact that when they were young they too got drunk, naked, arrested, high and realize that, as it turns out, so did everybody else.

      When everyone's naked pictures are on the internet naked pictures on the internet will cease to be career wrecking news.

      --
      If you don't risk failure you don't risk success.
    10. Re:Two real solutions ... by tm2b · · Score: 1

      No problem, glad to help!

      --
      "It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
  56. identity of viewer by climate_control · · Score: 2

    So X-pire's servers can track who has viewed which images when? That info could come in handy. Might even have a market value. Perhaps I should set up my own such system.

  57. facebook pre-processes images by Anonymous Coward · · Score: 0

    Facebook does some image processing before posting. For example, it resizes and it fucks up the colors and there is nothing you can do about it. This means if you post an encrypted image (i.e. random binary data) to it then you will not get it posted as an image at all.

    Too lazy to try but if they didn't do that they'd be open to all sorts of tricks with animated gifs and html code and whatnot.

    1. Re:facebook pre-processes images by Anonymous Coward · · Score: 0

      The company claims they can work around the facebook pre-processing. And their magic un-see-able images will still be un-see-able.

      Of course, the whole thing is still ridiculous.

  58. I am unimpressed... by fuzzyfuzzyfungus · · Score: 5, Interesting

    This particular "solution" sounds like the result of somebody thinking in a human-shaped problem space, which is psychologically understandable enough; but is a bias you have to get over if you want to get anywhere in tackling internet problems. And that is my best attempt at a charitable interpretation. Worst case, somebody is a dumbass.

    For the sake of charity, we will ignore obvious fuckuperry like "the project runs out of money in three months, and the keyservers go dark, millions of people's pictures(which, being users, they won't have backups of...) get hosed 15 months early" or "the keyserver gets rooted, a relatively small file called 'facebook_camwhores_dont_want_u_to_have_this.zip' appears on every torrent tracker on the wrong side of the tracks and the whole scheme collapses"...

    First, the same psychological biases(excessive time discounting, poor inhibition triggering models, bad stability assumptions) and social processes(booze, peer pressure, etc.) that cause people to post pictures and stuff that they will later come to regret will, almost certainly, cause them to assign incorrect 'blackout dates' to the material they do post. 18 months is like, what, 3 failed attempts at "serious" relationships, a number of booze fueled rebounds, and an ill-advised make-up or two? It is also plenty of time for what you did last summer to appear before school officials, what you did a few semesters back to make the HR snoop's radar, etc. Even in a world of purely human, purely manual, threats, this scheme is going to be minimally effective in protecting the people who need it most(while, at the same time, managing to scotch a bunch of happily-married-high-school-sweethearts who have lousy backup practices).

    Now, where this scheme really falls flat: This is the internet. It is more full of bots and spiders than is sci-fi written for the arachnid audience. Whatever tag or code is used to clue the plug-in in to the need for a decryption key is going to become a de-facto signal for "High probability of being juicy and/or embarassing". Now the bottom-feeding amateur porn sites won't even need humans or machine vision to find cheap filler content... Hell, facebook, and virtually all even slightly shady crawlers will likely fully support this scheme long before Apple approves iPhone support for it(Hey guys, now you can post your pictures to Facebook in a format your friends can't even see! Hooray!)...

    That's the basic problem, right there. If the internet's long memory were confined to some specific location, the simple solution would just be to lean on them legally to provide twilighting tools. Trouble is, the internet's memory is long. And it is distributed across countless entities and jurisdictions. And much of the copying between memory stores is automatic. And records may not exist of a copy operation having occurred. And, with cheaper HDDs, even individual users on cheap laptops are now a formidable chunk of storage. If this scheme ever takes off(doubtful), how long do you think it will be before there exists the following: An OSX application called "iCrawl" that has an excellent UI, costs $20, and crawls and archives the facebook profiles of friends, friends of friends, out up to N levels, 3 competing win32 applications(one trialware, $19.99, with a totally custom widget set, one free, that crashes all the damn time and doesn't work, and one free and more or less functional; but installs a trojan), and a set of python wrappers for unixlike operating systems that make crawling your friends and fetching decryption keys as easy as writing a few scripts?

    Barring the full-blown emergence of the dystopian trusted-computing future, with end-to-end DRM and hunter-seeker drones with worldwide lethal force authorization doing 24/7 traitor tracing, you don't get to time-limit stuff you put in widely accessible places on the internet. Sorry about that.

    1. Re:I am unimpressed... by Anonymous Coward · · Score: 0

      A couple of further considerations, two human, one machine:

      Implied trust metrics: Just as 'pleading the 5th' is typically used as a guilt signal in American court/crime TV shows, it would wholly fail to surprise me that, unless this scheme becomes used by virtually everybody, for virtually everything(which seems unlikely; because technological changes of this sort tend to take ages to push and because why would I want my 'Africa Vacation Pictures' to time out?), people who need to make snap decisions, like busy HR types, will simply use the number and/or percentage of images that are thus encrypted as a proxy trust metric, in place of the images they cannot see. Lots of blacked out material? Must have been quite the party person... Circular file.

      On the other side of the coin, if this service allows people to chose a twilight date, and that date is either visible or inferable, you may well run into the problem of people inferring other's trust in them from the twilight dates that others set. "You said this was forever; but 'Our first kiss' is set to black out at 6 months! WTF?" Again, the people most likely to be making juvenile or agency-compromised photo posts are quite likely the ones most likely to be easily drawn into absurd emotional drama over blackout dates.

      One technological: In order for this scheme to work, every encrypted image must have some sort of GUID(they could recycle them, I suppose; but that might lead to people being handed the wrong key when they hit an expired image, and possibly some interesting inferrential attacks...) so that the server knows what key to hand you. Thus, if you wished to sacrifice the disk space, it would be absolutely trivial to have a plug-in that slightly extended your browser's cache logic in the following manner: When the browser encounters an encrypted image for the first time, obtain the key, if available, and decrypt. Store the (GUID, plaintext) tuple and, if you ever see that GUID again, just load the plaintext.

      Disk is cheap, and people hate seeing broken links/missing images. A simple plugin like that(especially with the trend toward 'browser sync' services that keep multiple computers' browser state in sync, and could easily be extended to support merging the tuple caches from any number of cooperating clients) could do a lot to blunt the impact of this 'expiration' tool.

      Such caching would be particularly effective either unintentionally, if the cache became something that malware started to routinely look for, or if it were integrated with the iframe-or-equivalent-using "social" stuff like stumbleupon. I go to person X's facebook, get a sea of blanks. My socialstumblr plugin puts out a call to my friends list with the GUIDs that I need... It might integrate well with a bittorrent network...

    2. Re:I am unimpressed... by Anonymous Coward · · Score: 0

      Oh, and, of course, the one wildly stupid objection: Any guesses as to how long it will take for it to come up?

      Any tool that encourages joe shmoe to post encrypted blobs will, if successful, massively increase the number of such blobs, including ones for which no keys (apparently) exist. Bingo, steganographic communication is now even easier for every sort of narco-paedo-terrorist-na'er-do-well.... Just post an encrypted blob on facebook and everyone will assume that it is you passed out in a pile of your own vomit, thankfully now invisible, rather than whatever arbitrary communications you wish to hide.

      That is, of course, an idiotic objection; but every jackboot whose knowledge of technology extends to ear-radios and automatic weapons, and every quavering middle-aged reader of the Daily Mail, will flip out when somebody points out that adoption of this idea will make Facebook into a distribution system for arbitrary encrypted blobs 10s of millions of times the size of something like FreeNet....

    3. Re:I am unimpressed... by Anonymous Coward · · Score: 0

      (In a specifically British context, since the authorities have the power, under some circumstances, to compel you to disclose your crypto keys under penalty of law, a service like this could get sticky. If widely adopted, there will be tens of millions of encrypted blobs, whose keys have been deliberately, by design, lost, the overwhelming majority of them belonging to dumb schoolchildren and naked and/or wasted college students. Either everyone on Airstrip One will be a criminal within 18 months of using the service, or Osama Bin Islam al Jihad's "Nope, I don't have the keys, those were just some party pictures from college" defense is going to start looking a lot more plausible...)

    4. Re:I am unimpressed... by bugs2squash · · Score: 1

      What do you mean their keyserver going dark ?
      If I'm going to use something like this (not that I'm inclined to) I want the request to come to a keyserver that I directly control and facebook would never allow that.

      --
      Nullius in verba
    5. Re:I am unimpressed... by fuzzyfuzzyfungus · · Score: 1

      Given that their scheme is 3rd-party to facebook(if this were a facebook scheme, the crypto nonsense wouldn't be necessary, they could just have privacy controls that actually work, rather than being broken by design), I don't see why a keyserver run by you would be any less acceptable than a keyserver run by them(though you might have to resort to some horrid trick like using a placeholder image with the ciphertext embedded as EXIF data or something).

      I'm just inferring, based on the fact that this is aimed at the demographic that has a serious problem with posting embarrasing images to facebook, that their plans do not rely on users running their own keyservers. Nothing stopping you from implementing the same idea with your own keyserver(other than the idea being stupid); but my understanding of their plan was that they keyserver would not be something that the user is expected to manage(which, realistically, is probably a very sensible assumption on their part, though it certainly doesn't give the privacy wonks who will never need their services anyway the warm and fuzzies...)

  59. Oh, what a great idea! Now they just need... by Illogical+Spock · · Score: 1

    ... to turn impossible to capture the screen, to copy/paste the content in some photo edition program, to make every single system to cope with that, and to get a brain.

    --
    --- Illogical Spock
  60. Another completely misleading title by Anonymous Coward · · Score: 0

    Did NOT see that coming. I mean, on slashdot too? SAY IT AINT SO!

  61. Just another name for DRM by mseeger · · Score: 1

    Do a "/images/music/" and you will notice that you have seen this scheme before.....

  62. I just want to wait until . . by Anonymous Coward · · Score: 0

    the servers go down so not one can look at the image.

    Hope there are backups. Things like this mean potentually more things that will get lost as time goes by.

  63. Useless unless... by jeffrey.endres · · Score: 2

    The only value I can see in this would be if the resulting decrypted picture contains an individual tag for whoever decrypted it. Then when they save it via the gaping analogue hole or a simple print-screen, then the original poster has a chance to find out who released the copy and can suit them.

  64. Another way to look at it by Anonymous Coward · · Score: 0

    Here's another way to look at it. Imagine a few small adjustments to the scheme. Put some access controls on who can get the decryption key. Now you're uploading encrypted images to Facebook that Facebook cannot use! Facebook wants to claim excessive rights to the pictures I upload? OK, but good luck doing anything useful with an image full of static.

  65. It's been done by Animats · · Score: 1

    There have been a few previous schemes like this. Fileopen has one for PDF files. None have been very successful. They all rely on some central server for routine use of the content.

  66. missing the obvious point by Anonymous Coward · · Score: 0

    Ignore the encryption and the browser plugin for a moment, and consider: the third-party keyserver logs will contain a wealth of information about who looks at what, and this information is possibly *less* protected than Facebook, depending on the EULAs involved.

  67. Vanish by sakielnorn · · Score: 1

    Importantly, this looks to be a Facebook-specific implementation of Vanish, a project with the goal of making data "self-destruct" after a set period of time done by Roxana Geambasu and her colleagues at the University of Washington, linked here. They describe in their USENIX Security paper why encryption alone doesn't solve the problem.

  68. Nah it's a great idea by syousef · · Score: 1

    Slashdot users debunk this scheme as stupid in 5... 4... 3...

    Nah, it's a great plan. Can we have the expiry date based on image quality? Since most Facebook images are a blurry mess, they should all expire before anyone gets to see 'em. No more privacy scandals! Faster Facebook pae loads. And this X-Pire guy can continue to just sell his rubbish and slashvertise all he likes. Everyone wins.

    --
    These posts express my own personal views, not those of my employer
  69. It costs money too! by O-Deka-K · · Score: 1

    From TFA:

    "The X-Pire program should be available in late January and will cost 2 euros (£1.68) a month. Those who stop paying will not see their images suddenly become viewable, he said, instead they will just not be able to put expiration dates on new images."

    I'm sorry, but people who don't even care about their privacy enough to post risque pictures and make them available to the world are not likely to want to pay 2 euros a month to give them an expiry date. In fact, anyone who wants to view the images has to go and download the plugin first. Know what happens in that case? People don't bother and no one sees the pics.

    Partyman: Did you see the pics I posted from the party the other night?
    Friendface: I saw the gallery, but the pictures are all blank. It said something about requiring a plugin.
    Partyman, Yeah, you need to download the X-Pire plugin to see them.
    Friendface: Why?
    Partyman: I want my pictures to automatically expire after a few months so that they don't stay up too long.
    Friendface: Why don't you just remove them later?
    Partyman: Too lazy. I'd rather pay someone else to do it.
    Friendface: You had to pay?
    Partyman: Sure, it's 2 euro a month. So are you gonna download the plugin?
    Friendface: Nah, too lazy. I'll pay someone else to look at them.

  70. Because your not grasping the Tech? by tempest69 · · Score: 1

    Why is everyone saying screenshot? Once the image is on your screen, it's decrypted... it's yours, it's in the cache, it's on your harddrive. Not only that, if your cache is persistent, and you have a super long expiration on it, it'll be on your drive for X months which may end up being Their Date+X = new expiration. Oh, that person just got elected? Hmm, I looked at their profile 4 months ago, let me rummage in my cache.

    Your not getting the tech, it isnt saving a jpeg on your box ever. At best it's storing an encrypted jpeg in your cache. With an encrypted expiration key the software sends the expiration key, and gets the picture key via a secure transfer.
    Then the key is hanging around your machine in encrypted form, and doesn't need to be fully decrypted to use.
    This is a trick, certainly, and hard enough to implement --that the makers of xmpeg didn't bother-- leading to DVD encryption getting hacked.
    However a screen capture is a little trickier to defeat, but a good video memory probe can usually defeat that sort of lockout. But with some changes to video cards this could be locked as well.. one of the reasons that I don't plan to buy any displayport hardware if I can avoid it.

    from website: If the images are viewed using a browser in which X-pire! is not installed or using another software for viewing images, only a black and white image is shown with a text indicating where X-pire! can be downloaded (free of charge for solely viewing these images). The image remains protected. Protected? Is the text everywhere? Humans can't see in black and white? If it's past expiration is the image still visible in black and white with text on it? Or does it show expired?

    My guess is what they're showing is just text, and wont have any of the original picture to it.

    All in all I still think that this is a pretty sad excuse for software. And of course thy could actually be selling snake oil, and be hand-waving their way through encryption practices.

  71. Because the web isn't slow enough by Anonymous Coward · · Score: 0

    Will someone PLEASE think of the latency?

    This is definitely going to harm puppies.

  72. The Establishment method: by Burz · · Score: 1

    "Dear sirs, we are a large corporation with loads of cash and/or a large government and we need you to unlock some expired photos for our (innovation | life-saving charity | anti-terrorism | anti-CP | etc)..."

  73. Managing findability... by SonOfKrorg · · Score: 1

    ... is the real key to this problem.

    Think of some picture or fact you'd prefer went private and ask yourself this – it there was no reference to it on Google, Bing or FaceBook, how would anyone find it? For you to regain control, all it takes is for these corporations to apply some of their much-vaunted technological prowess and to hold themselves to some standards.

    The Knowledge Rights Forum - Help us create and promote a manifesto for the ethical handling of knowledge.

  74. Wait a minute... by NotQuiteReal · · Score: 1

    If the Print Screen button can be used to violate the DMCA, does that mean we are all criminals?

    --
    This issue is a bit more complicated than you think.
  75. DDOS? by Hypoon · · Score: 1

    Come on guys, this is Slashdot we're on here!
    There's another big problem with using a centralized server. As soon as someone wants to wreak havoc on Facebook, all they have to do is DDOS the key server. If this were to catch on and most images become encrypted like that, it'd be a pretty quick and easy way to upset a lot of people.

  76. nobody is thinking this through by circletimessquare · · Score: 1

    of course this scheme is completely idiotic

    but if it convinces idiots to upload pictures they shouldn't, with the false sense of security that they will eventually go away, that's more embarrassing pictures for us to gawk at

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
  77. Omniva/Disappearing Inc by yulek · · Score: 1

    This is just a rehash of the same technology that was used to make expiring email. Omniva/Disappearing Inc. was doing this at the turn of millennium and just like with this technology, the point wasn't to prevent a moderately determined person from making copies of the emails by doing a screen capture, printing the email (there was actually some cute technology "preventing" even that), or transcribing the damn thing. It was to apply document retention policy of corporations and government industries. And of course to raise money from gullible investors. I mean, after all, there are trillions of images being uploaded to Facebook every few seconds...

    --
    in this age of communication i'm just not getting through
  78. We had a good laugh about by soccerisgod · · Score: 1

    ... on heise.de when it was posted there some week or two ago. The stupid plugin costs money, too! 10 Euros per month, if you can believe that.

    Link to Heise article (google translation)

    --
    If a train station is a place where a train stops, what's a workstation?
  79. mshenrick by mshenrick · · Score: 1

    why don't they just: send the image if the expiration date has not passed! and my first rule of copying data is: if you can read it, you can copy it, so it will be broken pretty quickly

  80. mshenrick by mshenrick · · Score: 1

    this is almost as amusing as the 'not printable' wwf pdf format

  81. There may conceivably be an easier way by Keeper+Of+Keys · · Score: 2

    If this could ever actually work - which it can't - I wouldn't want my digital photos to expire anyway. BUT if anybody actually does want this, why doesn't facebook just delete them after the expiry date?

    1. Re:There may conceivably be an easier way by holamundo · · Score: 1

      If this could ever actually work - which it can't - I wouldn't want my digital photos to expire anyway. BUT if anybody actually does want this, why doesn't facebook just delete them after the expiry date?

      Facebook could say your photos were deleted, but how can you be sure?

  82. Perfect by curado · · Score: 1

    This opens the door for a new nvidia chipset to decrypt the encrypted images so that they can't be displayed w/o connection through an encrypted HDMI connection. It will be just like video overlays if you try to do a screen capture.

  83. 3 words by hicksw · · Score: 1

    Google Images. FAIL.

  84. Kneejerks all round.. by Anonymous Coward · · Score: 0

    Havign read the 2nd link, I'm amazed at

    1.) Kneejerk 1: Posting genuinely idiotic or destructive behaviour on the internet on a whim, stuff that will make you look like an idiot,
      (for instance posting pics of yourself partying, publicly, on Facebook of all places, when off-work on a different pretext). At least set the viewing permissions correctly..

    and

    2.) Kneejerk-2: How the narrow-minded and the puritanical now have the perfect tool to enforce conformity over people's private
    or at least non-work-related time, by the simple expedient of denying them livelihood or career - I'm thinking of the woman denied her degree over some trivial prank.
    This is no different in principal to what dictators have always done, except now the Holy Inquisistion is employers, trainers and administrators of universities.
    This is reducing freedom by a thousand cuts.

      P.S. I would still vote for the woman posing by the firetruck, if I thought she she could do the job she campaigned for. I wouldn't vote for her because of that photo, but I wouldn't vote against her for it, either. Unlike some, I accept that people have sexuality.

  85. Smells of conspiracy... by holamundo · · Score: 1
    One key component in the system is the "key server". Reading through their official site I could only dig up:

    Directly after installation https://keyserver.x-pire.net/ is the default for keyserver. Usually this is fine and you do not have to change this.

    How do we setup a keyserver ourselves? Wouldn't it be even more pointless if we entrust the keys to the x-pire guys? Now they can sit back and see the embarrassing images rolling in.

  86. You are of course correct. by goldcd · · Score: 1

    *pulls idiot-face at self in mirror*