7 ms·
You left out this: "As of March of 2016, the URL shortening option is no longer available in the OneDrive interface, and the account traversal methodology descr
by ladzoppelin 11y ago
You left out this:
"As of March of 2016, the URL shortening option is no longer available in the OneDrive interface, and the account traversal methodology described above no longer works."
Both companies still have not solved the existing link problem.
Edit:
As someone said below, Google still allows the short method with more entropy which is still insecure. MS does not allow shortening.
- chias 11y agoExcept that, according to Microsoft, this change had absolutely nothing to do with the report, which they still consider to be not-a-vulnerability.
- addicted 11y agoMaybe I'm missing something, but if the URL shortening feature doesn't exist anymore, how can it be a vulnerability? Edit: The issue would be with existing links, but it's difficult to change existing links for obvious reasons. Both MS And Google at this point have calculated that deleting existing vulnerable links would be worse than the security issues presented here.
- ignoramous 11y agoTo give them the benefit of the doubt, what they could have meant was that it was an onerous feature that swapped privacy for convenience. Besides, scanning of URLs should be prevented by bit.ly in this case, no? What's MSFT to do?
- scosman 11y agoWhat is insecure about more entropy + blocking scanners? By that rational any internet connected service with a password is insecure.