I’m going to use the Firefox extension Batch Download to download the pictures from a site like Smugmug. The CEO of Smugmug said that it was intended behavior that the private pictures at Smugmug were still publicly available which I do find a little bit odd but who am I to complain ?

Install the Batch Download Firefox extension and restart Firefox afterwards. Open the options of Batch Download afterwards, this can be done by right-clicking a blank space in Firefox and selecting Batch Download from the menu.

The Base Url is the url of the photo directory at Smugmug, in our case it is http://www.smugmug.com/photos/(*)-M.jpg. The Wildcard is the numeric part of each image that changes with each unique image. We define that part below. Since it consists only of numbers we use the numbers from 1 which would be the image 1-M.jpg to 10000 which would be image 10000-M.jpg.

Batch Download would now scan the directory photos at Smugmug for all images between 1-M.jpg and 10000-M.jpg, which means a total of 10000 images will be scanned. If an image is found it will be downloaded to the directory you specify at the bottom in the form entitled Download Folder.

The numbers that you enter are arbitrary. You could start by 10000 instead and end at 96000. It takes of course longer to download the images if you select huge numbers. This technique can be used for many different websites who save their images – or other files like videos – this way. It is furthermore possible to start over at a certain number where you stopped.

There are some ways of blocking Batch Download. The easiest way would be a referrer check which would ensure that only visitors from the same website would be allowed to download the files.

Related posts

• Webslices and Activities ported to Firefox (5)
• Use the Foxtor Extension for anonymous surfing (6)
• Use Splitlink for Firefox to check for Redirects (2)
• Url Fixer Extension for Firefox (3)
• Tiny Menus for Firefox (7)

The real problem arises because files are named sequentially at Smugmug which means that anyone with just a little bit of technical knowledge will be able to download all images from all galleries set to public and private. The only galleries that are not accessible are the password protected ones obviously.

The urls for the galleries can be accessed by opening a url starting with http://www.smugmug.com/gallery/*, for example http://www.smugmug.com/gallery/1000, http://www.smugmug.com/gallery/1001 in your browser. Pictures can be accessed directly by loading http://www.smugmug.com/photos/*-M.jpg in your browser where * is a number between 1 and x. So, everyone can access pictures like http://www.smugmug.com/photos/1000-M.jpg, http://www.smugmug.com/photos/10001-M.jpg and so on.

Google Blogoscope who discovered this loophole contacted Smugmug and received a reply that was not that satisfactory. According to CEO Don MacAskill this is the intended way it should work:

First of all, we view security and privacy as two separate, but related, issues. Security is like locking your front door (no-one can get in with out a key) and privacy is like closing your window drapes (no-one can look in from the outside, but you can tell people where you live and they can visit without a key).

At SmugMug, the feature you’re talking about, private galleries, falls under the privacy umbrella, not security. It’s intentionally designed so that you can “tell other people” about your photos (share a URL in an email, embed or hyperlink on your blog or message forum, etc) without having to share something like a password. Only people you’ve shared this URL with can find the gallery and/or photos in question.

Related posts

• Batch Download Pictures from sites like Smugmug (3)
• SmugMug Album Downloader (2)
• Photo Software: Photology (4)
• Move Photos Between Image Hosting Sites (4)
• Download pictures from webshots without logging in (5)