SAN FRANCISCO -- Applications that let consumers share their content, like Yahoo's Flickr, have made many a millionaire, and built a new generation of powerhouse companies. But with sharing come privacy concerns.

Flickr has found it can increase usage on its photo-sharing site by providing just enough privacy. Flickr developer Kellan Elliott-McCrea presented the company's concept of "casual privacy" at the Web 2.0 Expo, held last week in San Francisco.

"Sharing has been a great growth strategy for Web 2.0 companies. But there are things that people do want to share privately, including pictures of their kids, their homes, their weddings and last night's party," he told the audience. "We have very rich privacy controls already, but they can be too challenging for a lot of people."

Flickr's solution was GuestPass, launched in 2006. It creates a unique -- and very long -- URL photographers can send to others. Following the URL lets people bypass the Flickr login and see a private photo without having to register for the site. Only the photographer can create one. It also provides navigation hints, because a lot of people following it may be first-time visitors to Flickr. Last Tuesday, Flickr rolled out a "share this" button that lets you pull addresses from your address book or contact list. "It's huge because the people who are using it were not sharing before," Elliott-McCrea said.

Share nothing? Share everything?

He identified four models for sharing: share nothing, share everything, manage a crowd or casual privacy. The manage a crowd is the traditional model, it's about assigning roles, giving permissions. "The problem is, those models are insufficiently complex and yet too complex at the same time," he told the crowd.

GuestPass uses long, obscure URLs that are hard to guess but easy to implement. These URLs can be forwarded on to others, who can also follow them to see the photo. "We expect it to be propagated; it's a leaky privacy," he said. But it happens slowly, more like the way gossip might be passed along from friend to friend -- instead of the almost instantaneous way that scandal can permeate the blogosphere.

Elliott-McCrea recommended that companies that want to implement the casual privacy strategy make sure the URLs they generate are opaque, so you can't tell who made it. There should be no hinting in the error messages, such as, "I'm sorry but Leonard hasn't shared that photo with you." And no obvious gaps in the photo stream, for example, "Leonard has 37 photo streams, of which you can see 13."

They should also be revocable, so that people can change their minds later about sharing the content.

GuestPass-type URLs should be hard to guess. Flickr uses eight-digit alphanumeric URLs; if developers are willing to go up to 12 to 14 digits, they can check their validity on the client side, without querying the database. But Flickr hasn't found this level of security necessary.

There are some security concerns. "Your token will leak at a conference, much like a password," he warned. Proxies can be problematic and the data hygiene of centralized feed aggregators is not good.

Casual privacy is good enough for most Internet users, Elliott-McCrea said, but it may not be the right strategy for truly sensitive information. He cautioned, "If you're terribly worried about malicious leaks, casual privacy isn't for you."