O2 MMS Messages Visible by the Public
Anti-Spam company, MailChannels has found that O2 UK's web based MMS service is open to the general public without any form of user authentication. Although it is not possible to track down specific photos or O2 customer details, the move has caused concern amongst O2 customers chatting on the company's own customer care forum.
The web service is offered to O2 customers who want an online method of viewing their MMS messages. They have a specific URL which the O2 customer can send via email to other people to view the message online.
While the URL is based around a random hash number, it has transpired that the Google search engine is also picking up some of the messages as part of its routine spidering of the internet. The messages expire after a short time frame, but clicking on the "Cached" link under each search result allows anyone to see the photo.
A posting on the Matt Cutts blog which discusses anti-spam issues at Google comments that Google could only have found the URLs if someone had posted links to them on another website - such as sharing them on their own blog or via a discussion forum.
Whilst it is going to be inconvenient to put an authentication system into URLs which are meant to be shared - it would be possible for O2 to follow standard internet procedures to request search engines to ignore the pages so that they don't appear in search results.
Update:
As of Mon 21st July, the server providing the web service seems to have been shut down and even the Google cache will no longer display the MMS photos.
Posted to the site on 20th July 2008