# Privacy issues with attachment\_fu and amazon s3

**URL:** <https://www.ruby-forum.com/t/privacy-issues-with-attachment-fu-and-amazon-s3/170666>\
**Category:** Rails\
**Created:** [June 20, 2009, 6:01pm UTC](https://www.ruby-forum.com/t/privacy-issues-with-attachment-fu-and-amazon-s3/170666 "2009-06-20T18:01:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![amin1426](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4da419/32.png) [@amin1426](https://www.ruby-forum.com/u/amin1426)\
**Post date:** [June 20, 2009, 6:01pm UTC](https://www.ruby-forum.com/t/privacy-issues-with-attachment-fu-and-amazon-s3/170666/1 "2009-06-20T18:01:58Z")

</div>

I’ve set up attachment\_fu to save photos for my rails application to  
amazon s3. All works great but now I’d like to add some privacy to  
this.

So, if one of my users downloads a photo it is only viewable by that  
user.

One idea is to use the uuid\_primary\_key function to pseudo-randomize the  
pictures.

That is, the general public would have to guess the uuid\_primary\_key to  
steal the photos.

But, this is not completely safe and private.

Does anyone have any other ideas? Or should I view uuid\_primary\_key as  
safe enough?

---

<div class="post-metadata">

**Author:** ![amin1426](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4da419/32.png) [@amin1426](https://www.ruby-forum.com/u/amin1426)\
**Post date:** [June 20, 2009, 6:25pm UTC](https://www.ruby-forum.com/t/privacy-issues-with-attachment-fu-and-amazon-s3/170666/2 "2009-06-20T18:25:36Z")

</div>

On Sat, Jun 20, 2009 at 6:01 PM, John  
Clancy[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> That is, the general public would have to guess the uuid\_primary\_key to  
> steal the photos.
> 
> But, this is not completely safe and private.
> 
> Does anyone have any other ideas? Or should I view uuid\_primary\_key as  
> safe enough?

Amazon have a system where you can set a private url that expires  
after a short time.  
The expiry is encoded into the url so it can’t be changed.  
Attachment\_fu supports it with something like:  
file.authenticated\_s3\_url(:thumb, :expires\_in =\> 5.minutes.to\_i)

Andrew T.  
[http://ramblingsonrails.com](http://ramblingsonrails.com)

[http://MyMvelope.com](http://MyMvelope.com) - The SIMPLE way to manage your savings