Wednesday, January 11, 2012

Security_System

For those who might think that the photos that are uploaded in your profile is not safe from any second person from whom the photo is hidden, might think again and thanks to the security system adopted by the fb.
let me confront you with the way the numerous url are made in the dynamic manner or at run time that nobody can even view your photo or may be(if he is you)!!!!!


(I use "shem" in place of "Facebook")

lets make an environment of a profile to make the understanding a bit easy for the fb users or in their own manner:

Suppose there a profile of a user having profile id= 10000000000000(15 digit number and this is variable number)

Suppose the user has three albums named as
a) Wall Photos
b) Mobile Uploads
c) December Birthday

All three photo albums of the user is kept under a link in profile called- "Photos"

4)When a user click on the link "photos" then the URL consists of:

https://www.shem.com/?sk=photos

5)When a user click on link "Wall Photos" then URL consists of:

https://www.shem.com/media/set/?set=a.(AlbumNo1).(MagicNo1).Profileid&type=3

here-
AlbumNo.1= a unique one time generated number for a particular album of the user(Length = 15 digits)
MagicNo.1= a number generated in accordance with the album no. and its length= 4-5 digits(max 5)
Profile id= its a unique number given to every profile on fb which in some of the user cases is replaced by a name

6)When a user clicks on any of the 6 photos inside the album "Wall Photos" then 6 URL's are-

a) https://www.shem.com/photo.php?fbid=(photono1) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater
b)  https://www.shem.com/photo.php?fbid=(photono2) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater
c) https://www.shem.com/photo.php?fbid=(photono3) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater
d) https://www.shem.com/photo.php?fbid=(photono4) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater
e) https://www.shem.com/photo.php?fbid=(photono5) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater
 f) https://www.shem.com/photo.php?fbid=(photono6) & set= a.(AlbumNo1).(MagicNo1).Profileid&type=3 & theater

Note= the difference between the different photono is only the last 9 digits out of the 6 starting digits
i.e.

fbid=145111578945689 
fbid=145111412356974
fbid=145111457986523
fbid=145111147852369
fbid=145111897916478
fbid=145111781124589
here one can see that the starting 6 digits are same where as the last 9 digits changes with the every photo.

7)When a user clicks on the link "Mobile Uploads"

https://www.shem.com/media/set/?set=a.(albumno2).(magicno2).profileid&type=3

8)When a user clicks on any of the 6 photos in mobile uploads then the 6 URL are like-
https://www.shem.com/photo.php?fbid=(photono7) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater
https://www.shem.com/photo.php?fbid=(photono8) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater
https://www.shem.com/photo.php?fbid=(photono9) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater
https://www.shem.com/photo.php?fbid=(photono10) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater
https://www.shem.com/photo.php?fbid=(photono11) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater
https://www.shem.com/photo.php?fbid=(photono12) & set= a.(AlbumNo2).(MagicNo2).Profileid&type=3 & theater

Again note that the photono generated here is that 15 digit value only where the first 6 digits are same and the rest of the digits are different.
fbid=208340898754652
fbid=208340451223457
fbid=208340784124517
fbid=208340598756235
fbid=208340547896325
fbid=208340147894796

So it result into some crucial results which describes the security provided in fb ie. the fbid which a 15 digit number is generated for every photo on fb of a particular user whereas the album number and the magic number is the one time generation which is created with the each album creation.So overall the URL's thus generated for the each album and the photo is dynamic due to random creation of these numbers and therefore if sombody happens to enter such URLs then he wont be able to find the one for the photo or the album which a particular user hide it from the users of fb around the globe.

1 comment: