Slashdot Mirror
Facebook Images To Get Expiration Date
Pickens writes "BBC reports that researchers have created software that gives images an expiration date by tagging them with an encrypted key so that once this date has passed the key stops the images being viewed and copied. Professor Michael Backes, who led development of the X-Pire system, says development work began about 18 months ago as potentially risky patterns of activity on social networks, such as Facebook, showed a pressing need for such a system. 'More and more people are publishing private data to the internet and it's clear that some things can go wrong if it stays there too long,' says Backes. The X-Pire software creates encrypted copies of images and asks those uploading them to give each one an expiration date. Viewing these images requires the free X-Pire browser add-on. When the viewer encounters an encrypted image it sends off a request for a key to unlock it. This key will only be sent, and the image become viewable, if the expiration date has not been passed."
Slashdot users debunk this scheme as stupid in 5... 4... 3...
Cue the plugin which takes a screen capture of the decrypted image and re posts it in its original form. If you can read it you can copy it forever.
I can't quite figure out how they'll stop me from taking a screenshot of the encrypted image.
All God does is watch us and kill us when we get boring. We must never, ever be boring.
your feeble encryption is no match for my clipboard.
because you can't lock the print screen out, right?
`echo $[0x853204FA81]|tr 0-9 ionbsdeaml`@gmail.com
I wish Facebook would expire... the sooner, the better.
What one fool can do, another can. (Ancient Simian Proverb)
"tagging" something with an "encryption key" is something which doesn't make a lot of sense. I guess maybe someone would want to search for the file based on the key it was encrypted with? *grin*
You know an article is quality when stupid crap like that shows up in the very first paragraph. Who do these big media outlets hire to do their sci/tech articles anyhow? Apparently people who haven't got the faintest clue how things work, or how to explain to others how they work. Somehow, they seem to consistently find the absolutely *least qualified* people to write such articles.
Which will result in something like the "X-Pire-copy-to-imgur browser add-on" which automatically decrypts the image and then posts a decrypted copy to imgur or whatever sharing site you want to use.
Not to mention all the large companies trolling facebook for photos and storing them for later use to provide background check style services/etc.
Once you post it, a copy has been made, once someone views it, a copy has been made. Those copies are outside your control. Even if you encrypt it, once someone views it, an unencrypted copy has been made, and it's once more out of your control.
We will just get used to this. One day, we will have to accept that nobody is perfect anyway.
*facepalm*
This whole concept should be on The Daily WTF.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
I'm ready to start a new service called Un-X-Pire. What you will do is run my browser add-on, which will find X-Pire tagged images, request the decryption key from the X-Pire service, and then cache it the first time it is requested for each image. After that, it will just serve out the decryption key over and over (or, if the decryption does something fancy like swap keys based on current time, it will go ahead and decrypt the image for you by spoofing the time the key was initially first cached as the current system time for the decryption process), and then everybody who uses my plug-in will be able to view the image for the rest of eternity so long as at least one person views it with my plugin before it expires.
Also, I bet mine takes a lot less time to code than theirs.
If Facebook actually wanted pictures to have a shelf-life, they could just allow you to add a default date+x when they would be pulled.
Facebook haven't done this, so I'm guessing they're either a bit short of development cash - or don't want this.
So, how might this work?
Well I'm guessing that either it's:
a brand new file format and the browser requests an external key when the photo display plugin kicks in - so so unlikely to take off, I'll just leave it there.
OR
it's encrypts the image and embeds in tags so the 'plugin' can detect it's a 'special image' and goes off to find a key to decrypt it.
Assuming it's the second, it has my interest. Sounds a little bit interesting - but then I start thinking.
If it's encrypted it's going to have 'look random' - so that's ballsed up the compression ratios of the jpg you uploaded.. and then well most sites tend to compress/thumbnail/crop or a combination of the above... well I don't quite see that working - no it couldn't
I guess maybe we're onto option C, I've just thought of. You don't upload the image, you upload a QR style pointer to the image - and the browser just inserts that in-line?
Well, maybe that would work.. but then these researchers just seem to have come up with a way of replacing an <img src= with a graphical pointer..
Oh and as everybody else has undoubtedly posted whilst I typed this, printsrn.
Maybe there's a market somewhere for pushing the whole public key encryption seamlessly into "stuff we upload" - to restrict or monitor view - but the problem that's never going to go away is that if one person can open it and wants to share it, then there's no security.
development work began about 18 months ago
18 months to build this seems an awful lot, doesn't it? Ubuntu has released 3 versions in such a period!
Pretty good is actually pretty bad.
If the employer is that anal about off hours activities, it may well be better to not work there in the first place.
comment first, facts later. http://chem.tufts.edu/AnswersInScience/RelativityofWrong.htm
Here's a better idea that won't require any additional plugins or new technology to be created: Don't upload pics to Facebook or any other so-called "social networking" site that you don't want available to the public forever. We'll call this idea "common sense".
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Of course, we have plenty of anti-drug propaganda to keep us far from the ideal. A picture of someone taking a bong hit at a party could be reason to be rejected from a job -- there are still places that perform pre-employment drug screenings, last I checked, and photographic evidence of illegal drug use may not go over so well. When we keep telling people that anyone who uses illegal drugs is an unreliable drug abuser who couldn't possibly hold a job, and when we require people to maintain a "drug free workplace" or forfeit government contracts, the idea that employers will forgive some college partying seems a bit far fetched.
Palm trees and 8
I am kind of used to Slashdot headlines that exaggerate the original article, but how do you go from a company has made some software that might be useful to social networks *like* Facebook to Facebook is going to get images with expiration dates?
(1) Have facebook support user defined expiration dates.
(2) Have facebook allow a user to subcategorize friends, subcategories would just be a configuration item not a publicly displayed state. Perhaps family, friends and coworkers. You can then tag photos to be only shown to particular subcategories.
So X-pire's servers can track who has viewed which images when? That info could come in handy. Might even have a market value. Perhaps I should set up my own such system.
This particular "solution" sounds like the result of somebody thinking in a human-shaped problem space, which is psychologically understandable enough; but is a bias you have to get over if you want to get anywhere in tackling internet problems. And that is my best attempt at a charitable interpretation. Worst case, somebody is a dumbass.
For the sake of charity, we will ignore obvious fuckuperry like "the project runs out of money in three months, and the keyservers go dark, millions of people's pictures(which, being users, they won't have backups of...) get hosed 15 months early" or "the keyserver gets rooted, a relatively small file called 'facebook_camwhores_dont_want_u_to_have_this.zip' appears on every torrent tracker on the wrong side of the tracks and the whole scheme collapses"...
First, the same psychological biases(excessive time discounting, poor inhibition triggering models, bad stability assumptions) and social processes(booze, peer pressure, etc.) that cause people to post pictures and stuff that they will later come to regret will, almost certainly, cause them to assign incorrect 'blackout dates' to the material they do post. 18 months is like, what, 3 failed attempts at "serious" relationships, a number of booze fueled rebounds, and an ill-advised make-up or two? It is also plenty of time for what you did last summer to appear before school officials, what you did a few semesters back to make the HR snoop's radar, etc. Even in a world of purely human, purely manual, threats, this scheme is going to be minimally effective in protecting the people who need it most(while, at the same time, managing to scotch a bunch of happily-married-high-school-sweethearts who have lousy backup practices).
Now, where this scheme really falls flat: This is the internet. It is more full of bots and spiders than is sci-fi written for the arachnid audience. Whatever tag or code is used to clue the plug-in in to the need for a decryption key is going to become a de-facto signal for "High probability of being juicy and/or embarassing". Now the bottom-feeding amateur porn sites won't even need humans or machine vision to find cheap filler content... Hell, facebook, and virtually all even slightly shady crawlers will likely fully support this scheme long before Apple approves iPhone support for it(Hey guys, now you can post your pictures to Facebook in a format your friends can't even see! Hooray!)...
That's the basic problem, right there. If the internet's long memory were confined to some specific location, the simple solution would just be to lean on them legally to provide twilighting tools. Trouble is, the internet's memory is long. And it is distributed across countless entities and jurisdictions. And much of the copying between memory stores is automatic. And records may not exist of a copy operation having occurred. And, with cheaper HDDs, even individual users on cheap laptops are now a formidable chunk of storage. If this scheme ever takes off(doubtful), how long do you think it will be before there exists the following: An OSX application called "iCrawl" that has an excellent UI, costs $20, and crawls and archives the facebook profiles of friends, friends of friends, out up to N levels, 3 competing win32 applications(one trialware, $19.99, with a totally custom widget set, one free, that crashes all the damn time and doesn't work, and one free and more or less functional; but installs a trojan), and a set of python wrappers for unixlike operating systems that make crawling your friends and fetching decryption keys as easy as writing a few scripts?
Barring the full-blown emergence of the dystopian trusted-computing future, with end-to-end DRM and hunter-seeker drones with worldwide lethal force authorization doing 24/7 traitor tracing, you don't get to time-limit stuff you put in widely accessible places on the internet. Sorry about that.
The only value I can see in this would be if the resulting decrypted picture contains an individual tag for whoever decrypted it. Then when they save it via the gaping analogue hole or a simple print-screen, then the original poster has a chance to find out who released the copy and can suit them.
If this could ever actually work - which it can't - I wouldn't want my digital photos to expire anyway. BUT if anybody actually does want this, why doesn't facebook just delete them after the expiry date?