Photo Kiosk at Marriott Marquis San Francisco - Everyone Can See Your Pictures (and more)



So you took your picture at that cool looking kiosk at the Marriott Marquis in San Francisco while out at the RSA Conference. You know, the one setup there by Pacific Digital Signs? Cool. Then you get the email that includes a link to www.isnap.com so you can get your picture. Nice! 

When you view your picture it looks pretty good. Check out mine.


This page also informs you of the following:


Well, thats not exactly true. Here is the URL to my picture: 

http://www.isnap.com/desktop/picture.php?id=1362658 

Yes, it's as silly as you think it is. Change up the "id=" value and you will see everyone else before and after me that took their picture on this kiosk. Neato! 

http://www.isnap.com/desktop/picture.php?id=[######]

As a matter of fact, if you play around a bit you will see that you can access pictures of people taken at other places like the Luxor in Las Vegas and even a few Cruise Lines! Back .... like.... years ago. 

For Pacific Digital and Isnap, I suggest you fix this. And no, this is not hacking. This is a poorly designed service that is far from "private" or "not publicly viewable."