5 ms·

Honestly this title feels a bit like FUD. Sure restricting the space of possible URLs decreases the difficulty of brute forcing urls, but honestly if you don't

Honestly this title feels a bit like FUD. Sure restricting the space of possible URLs decreases the difficulty of brute forcing urls, but honestly if you don't want something publicly accessible put it behind a auth wall.

scrollaway 11y ago
Agreed (to an extent). The real problem with URL shorteners is their longevity. Some routinely delete old URLs and all will most certainly be gone within the next decades.
- blowski 11y ago
  I agree that's a problem, but it's not really relevant to the article.
tremon 11y ago
Yes, the title does. But let's take a look at the actual content: OneDrive generates short URLs for documents and folders using [..] the same tokens as bit.ly. [..] In our sample scan of 100,000,000 bit.ly URLs with randomly chosen 6-character tokens [..] 19,524 URLs lead to OneDrive/SkyDrive files and folders, most of them live. [..] From the URL to a single shared document (“seed”), one can construct the root URL [from which] it is easy to automatically discover URLs of other shared files and folders in the account In other words, the links provided by these shorteners contain authorization information. And: Around 7% of the OneDrive folders discovered in this fashion allow writing. And in the case of Google Maps: goo.gl/maps URLs used 5-character tokens. Our sample random scan of these URLs yielded 23,965,718 live links, of which 10% were for maps with driving directions. These include directions to and from many sensitive locations: clinics for specific diseases (including cancer and mental diseases), addiction treatment centers, abortion providers, correctional and juvenile detention facilities, payday and car-title lenders, gentlemen’s clubs, etc. The endpoints of driving directions often contain enough information (e.g., addresses of single-family residences) to uniquely identify the individuals who requested the directions
- dsmithatx 11y ago
  In other news, some people use password as their password and 123 456 as the combination to their briefcase!
  - scrollaway 11y ago
    The difference is when those tokens are autogenerated for the user and the user may not even know about it, let alone know about the risk. A better analogy would be when routers ship with a default world-viewable admin UI and admin as its password.
- blowski 11y ago
  Thanks. This was a good summary of the problem. Do Google et al not have any kind of rate limiting which looks at suspicious behaviour like scanning lots of short URLs?
  - abalos 11y ago
    Did you read the article? At the bottom it said that they have both increased the key size to 11 or 12 characters and deployed methods for preventing the brute forcing of these URL's. I think that it's safe to assume that one of these methods is rate limiting.
    - blowski 11y ago
      Thanks. I asked specifically about rate limiting as the article didn't specifically mention it.
dsmithatx 11y ago
Also everyone should be smart enough to realize a public short URL isn't security. There are public one time password sites that provide a far more secure way to share a file quickly IMHO.
- barrkel 11y ago
  Is your grandmother "smart" enough to realize this? I think your expectations about the "smartness" of the public are not justified. It's not actually about smartness; it's about information theory. Not everybody is as up to date as you are.
  - jpindar 11y ago
    Is it the age, gender, or reproductive status of grandmothers that make them less intelligent or less 'up to date' than other people?
    - barrkel 11y ago
      Like I said in the second sentence of my post, it's not about intelligence, it's about knowledge: specifically, knowledge of information theory. Grandmothers, as a general rule, are less likely to know about Shannon entropy than the population of HN readers and their milieu (hackers, it's in the name of the site).
  - dsmithatx 11y ago
    This question is a red herring IMO. Are grandmothers sharing secret information via 5 character encoded URL shorteners? Maybe so or maybe the typical person who would use a public URL shortener to share secret documents isn't a clueless grandma.
deleted 11y ago
[deleted]

scrollaway 11y ago

Agreed (to an extent). The real problem with URL shorteners is their longevity. Some routinely delete old URLs and all will most certainly be gone within the next decades.

blowski 11y ago
I agree that's a problem, but it's not really relevant to the article.

tremon 11y ago

Yes, the title does. But let's take a look at the actual content: OneDrive generates short URLs for documents and folders using [..] the same tokens as bit.ly. [..] In our sample scan of 100,000,000 bit.ly URLs with randomly chosen 6-character tokens [..] 19,524 URLs lead to OneDrive/SkyDrive files and folders, most of them live. [..] From the URL to a single shared document (“seed”), one can construct the root URL [from which] it is easy to automatically discover URLs of other shared files and folders in the account In other words, the links provided by these shorteners contain authorization information. And: Around 7% of the OneDrive folders discovered in this fashion allow writing. And in the case of Google Maps: goo.gl/maps URLs used 5-character tokens. Our sample random scan of these URLs yielded 23,965,718 live links, of which 10% were for maps with driving directions. These include directions to and from many sensitive locations: clinics for specific diseases (including cancer and mental diseases), addiction treatment centers, abortion providers, correctional and juvenile detention facilities, payday and car-title lenders, gentlemen’s clubs, etc. The endpoints of driving directions often contain enough information (e.g., addresses of single-family residences) to uniquely identify the individuals who requested the directions

dsmithatx 11y ago
In other news, some people use password as their password and 123 456 as the combination to their briefcase!
- scrollaway 11y ago
  The difference is when those tokens are autogenerated for the user and the user may not even know about it, let alone know about the risk. A better analogy would be when routers ship with a default world-viewable admin UI and admin as its password.
blowski 11y ago
Thanks. This was a good summary of the problem. Do Google et al not have any kind of rate limiting which looks at suspicious behaviour like scanning lots of short URLs?
- abalos 11y ago
  Did you read the article? At the bottom it said that they have both increased the key size to 11 or 12 characters and deployed methods for preventing the brute forcing of these URL's. I think that it's safe to assume that one of these methods is rate limiting.
  - blowski 11y ago
    Thanks. I asked specifically about rate limiting as the article didn't specifically mention it.

dsmithatx 11y ago

Also everyone should be smart enough to realize a public short URL isn't security. There are public one time password sites that provide a far more secure way to share a file quickly IMHO.

barrkel 11y ago
Is your grandmother "smart" enough to realize this? I think your expectations about the "smartness" of the public are not justified. It's not actually about smartness; it's about information theory. Not everybody is as up to date as you are.
- jpindar 11y ago
  Is it the age, gender, or reproductive status of grandmothers that make them less intelligent or less 'up to date' than other people?
  - barrkel 11y ago
    Like I said in the second sentence of my post, it's not about intelligence, it's about knowledge: specifically, knowledge of information theory. Grandmothers, as a general rule, are less likely to know about Shannon entropy than the population of HN readers and their milieu (hackers, it's in the name of the site).
- dsmithatx 11y ago
  This question is a red herring IMO. Are grandmothers sharing secret information via 5 character encoded URL shorteners? Maybe so or maybe the typical person who would use a public URL shortener to share secret documents isn't a clueless grandma.

deleted 11y ago

[deleted]