Downloading photos

Over time, I’ve run across a few people who have posted photos to Flickr, set the Flickr option to disable downloading, and then been dismayed to find that people were saving copies of their photos anyway. They told Flickr not to allow downloading, and people can, apparently, still download.

Some of these had set the option a long time ago. With recent changes to Flickr, they’ve made it a little clearer that this isn’t a security feature, but even with that, people don’t understand what’s going on, and how others can still download their photos.

Here’s how the Flickr setting works:

You’re looking at a photo on Flickr, and you view a specific size (click on the photo or click the Action pull-down, then select view all sizes). Above the photo in the view all sizes screen is the license information and a list of sizes, and between them it says Download and supplies a download link. Also, if you right-click (Mac: ctrl-click) on the photo, there’ll be a save image selection on the menu.

If the owner of the photo has disabled downloading, the Download line will say The owner has disabled downloading of their photos, and there will be no save image option on the pop-up menu (on some browsers it may be there, but it won’t work).

What’s important to understand is that that’s all the option does: it removes the ability to save the image (photo) using the standard browser interfaces. That is, it makes it less convenient to save the image.

But any image that’s displayed by your browser has an img tag in the HTML source, and that tag has the URL for the image. For example, if we look at this photo that I’ve posted to Flickr, and then view the HTML source for the page,^[1] you’ll see the following:

<div id="allsizes-photo">
<img src="http://farm4.static.flickr.com/3136/3047554534_723e36b41f_b.jpg">
</div>

You can put that URL into your browser and get directly to the image. Of course, it doesn’t matter, because you can just right-click the image on the all-sizes page and save it. But if I had disabled downloading, when you looked at the page source you would see this:

<div id="allsizes-photo">
<div class="spaceball" style="height:768px; width: 1024px;"></div>
<img src="http://farm4.static.flickr.com/3136/3047554534_723e36b41f_b.jpg">
</div>

That extra line, the one with class="spaceball", is what blocks the right-click from being able to download the photo. But the URL is still there, and the URL still works. Anyone can still download my photo by going to the HTML source and finding the URL for it there. It would be very easy to write a Firefox add-on that would do this automatically and re-enable a save option on the pop-up menu, and it wouldn’t surprise me if someone had already written one. I haven’t looked, because I don’t really care to download everyone’s Flickr photos.

Here’s Flickr’s warning about this:

Enabling this setting also places deterrents to discourage downloading of your other sizes. (And we really do mean discourage. Please understand that if a photo can be viewed in a web browser, it can be downloaded.)

Is that sufficient? Clearly not; people are still surprised when they find that their photos are freely accessible to anyone who can get to the pages to view them. But if the web browser can retrieve the photos to show them, then they can be saved — if nothing else, they’re saved in the user’s browser cache, and a savvy user can snag them thence.

I’ve been talking about Flickr, specifically, but there’s nothing here that’s really specific to Flickr. It’s true on any web site: anything a user can view, the user can save.

There is an exception to that: there are photo sites that use Flash to show the photos. Flash is a browser plug-in that runs programs that are sent from the web server. The Flash program that displays the photos does it in a way that the browser itself is unaware of (only Flash sees it), so the browser never has the photo, nor even the URL to it. Unless someone can hack the Flash program, there’s no way the user can save the photo directly.

But even in this case, a user can capture a screen image while the photo is being displayed. The Mac’s Preview program makes it easy; use the File -> Take Screen Shot option in Preview’s menu. In Windows, pressing the Print Screen key on the keyboard will copy the screen image to the clipboard, and you can then paste it into a program such as Paint, PowerPoint, or PhotoShop. There are also plenty of other programs (I like Hypersnap, but many others are fine) that give you more flexibility.

In other words, again, anything a user can view, the user can save.

So, in general, we get back to advice that you’ve seen many times in these pages: If you want something to be private, don’t put it on the Internet.

---

^[1] It’s easy, from the browser’s menu: in Firefox, use View -> Page Source; in Chrome, View -> Developer -> View Source; in Safari, View -> View Source; in Internet Explorer, View -> Source.