Secure photo viewing on the web

[Badlad]

Hi all

I'm looking for a method where a small group of cavers can view a building gallery of photographs privately on the web.  The photos have a commercial value and should not be downloadable and must be secure within the selected group and the wider web. 

Can anyone offer any suggestions or advice.  Thank you in advance.

 

[Duncan S]

If it can be viewed then it can be downloaded.
Using Javascript to disable right click is trivial to work around.
Galleries implemented in Flash are much harder to rip (not impossible) and they are a real pain to view on a slow/normal speed connection.
Watermarking is not a deterrent to images being used on social media and I've found it is surprisingly easy to remove watermarks regardless of how much of the image they obscure.
The only effective solution is to lock down the gallery.

Have a look at Flickr private groups, they might be what you are after.
Only invited group members can see the group images.

My landscape images are hosted on Smugmug which allows me to create password protected galleries.
Different way of tackling the same problem.

Whatever solution you go for, make sure direct links to the images are also protected, not just the gallery pages.
That sounds blindingly obvious but you'd be surprised how often that works.

 

[TomTom]

Theres also the dropbox option where (in laymans terms) you only allow certain email addresses to get in. As Duncan says theres lots of ways round systems that stop you downloading images so I'd say use lower res images if you want some protection.

 

[graham]

TomTom is right.

If you must share photos over the web, they cannot be made wholly secure. Share lower res copies, which will be perfectly adequate for viewing on screen & keep the high res ones off the web & only use for specific purposes.

Any system that uses somebody else's server is open to hacking if someone really, really, wants to & that includes using Dropbox, though a numbered rather than named file in that should be relatively hard to find unless you know where to look.

 

[Inferus]

It depends if you want to host the photos yourself or, as suggested above, use a number of external websites where you can set/limit access to certain users - this would be the simplest method.

If you want to host them yourself/on own web-site/space then as above, Javascript or other client side options are limited in their effectiveness. A server side option option (.htaccess / password protected folder) is better. Some webhosts allow protected folders to be set up without meddling with or creating .htaccess files. This method allows a list of users and passwords to be created so everyone has their own login and trying to view the folder/webpages/photos will require them to login (a bit like some caving clubs that have members sections).

 

[Badlad]

Thanks for the advice so far.  Do you think it safer to use a personal website with a back side only viewable by invited log in - or one of the commercial photo viewing sites with access by invitation?

The photographer wishes to protect his photographs for future commercial sales, but at the same time he wishes those who have helped him to see the results.

 

[graham]

Depends how good your coding skills are. If you know how to build a personal website to do that then yes, it's safer to do it yourself. An awful lot of the commercial sites have quite impenetrable copyright statements & can change their T&Cs on a whim.

 

[cavermark]

Do you think it safer to use a personal website with a back side only viewable by invited log in ?

Definitely don't want to be viewing back sides publically 

 

[Mike Hopley]

Depends how good your coding skills are. If you know how to build a personal website to do that then yes, it's safer to do it yourself.

I agree that it depends on your coding skills. I differ about the level required.

In terms of security, I would trust (e.g.) Dropbox over almost any professional web developer -- and it's not even a close competition. Security is much, much harder than you probably think it is. Few websites come even close to getting it right.

Here's a quick test. Do you know what Bcrypt is? No? Then you don't know enough about security to get it right.

Anyway, back to the main question: there are no effective technical methods for protecting images. Anything I can see on my computer screen, I can easily copy. Your methods of protecting them must ultimately be based on trust and damage limitation.

By limiting access to people you trust, you are much less likely to have content stolen. This could be done in various ways. You could use a third-party service with some kind of private invite-only group. You could make a website with basic authentication, or you could make a website with "logon" (i.e. session-based) authentication -- like the logon for these forums, except limited to email addresses or usernames that you specify.

I think the easiest option is probably to investigate private groups on Flickr, or something similar.

You can also think about damage limitation. Low resolution or watermarking may help, depending on your needs. And if people copy images and put them on the web, you can send a DMCA notification -- effectively a formal complaint to their web host. This pretty much always works, although it's a bit tedious.

 

[Cookie]

Here's a quick test. Do you know what Bcrypt is? No? Then you don't know enough about security to get it right.

Er, actually I do.  :tease:

 

[Mike Hopley]

Er, actually I do.  :tease:

So my test has succeeded in identifying someone who knows about security?

 

[Cookie]

I wouldn't claim that - it is a massive subject.

 

[bubba]

Have a look at Flickr private groups, they might be what you are after.
Only invited group members can see the group images.

Agree - I would have thought Flickr private groups would be the easiest no-cost option.

 

[Mike Hopley]

I wouldn't claim that - it is a massive subject.

You continue to provide evidence that you understand security.

If you know enough to know how little you know, then you're in a good place.

 

[Amy]

If the person is that concerned, print some 8x10's and create a classic physical portfolio. Show friends. Done

But most people will expect to see an online gallery these days.

 

[pwhole]

I use .htaccess files on folders I want to protect and that seems to work fine - as long as the folks you give the passwords to can be trusted, then that should be secure enough? And using Flash galleries does stop the casual thief relatively easily, apart from screengrabs obviously - I generate them from Photoshop Bridge, and they're fairly painless to create.

 

[grahams]

Hi Badlad. The replies you've had so far indicate rightly that relying on security isn't the right way to go about this. The fundamental problem with security is that there is no means of knowing the capabilities of your opponent.

You could instead use secrecy. If you're building your own website you could simply avoid linking from the main site to the galleries that you want to protect. Your group could access the galleries via an emailed URL. Even if someone knew what to search for, these galleries would not be visible to a Google search. This will affect your Page ranking as unresolved links will be marked down.

You have additional protection in that no commercial organisation that might want to steal your images is going to be interested in JPG images of computer display size - they will be after the high resolution originals rather than small images uploaded in a lossy format.