4 ms·
The fact that anyone considers a shortened URL as a means to secure a piece of data outside of authentication saddens me. I think that should be the key point
by patcheudor 11y ago
The fact that anyone considers a shortened URL as a means to secure a piece of data outside of authentication saddens me. I think that should be the key point here. Did you just get a URL that gives you a bit of data without the need to authenticate? Then it's not secure.
- deleted 11y ago[deleted]
- matt4077 11y agoHow is a URL with that's not linked anywhere different from a password?
- skybrian 11y agoA secret kept in a URL is less likely to be treated as confidential, both by people and machines. For example, compared to a cookie, they're more likely to be shared or logged.
- jakobegger 11y agoIt is not. The problem is that short URLs are often only six characters long, so they are just as safe as a six character password (ie. not very safe)
- patcheudor 11y agoFar less safe because you use a password in combination with a userID so to crack someone's account you must have their login name and password. Six characters are six characters, easy.
- tedmiston 11y agoOne difference is a GET is likely to have less/no rate limiting vs. a login POST, making it faster to brute force.
- mikegerwitz 11y agoAre you confident that it doesn't appear anywhere else? There's two main concerns: the first being that you use a URL differently---and think of it differently---than a password; and the URL persists in various forms. Accessing a resource on the Web might be logged in numerous places---e.g. your web history and internal network logs or MITM if not over https---and might be sent as metadata, like a referer header to another website. Imagine if all of your passwords were logged by your client any time you entered them in.
- mikegerwitz 11y agoI don't mind downvotes (and this appears to only have been downvoted once), but I do want to express legitimate concern over that: what I said is a standard security concern, and precisely why you don't put sensitive information in GET requests. I hope that others aren't dismissing this issue.
- gedrap 11y agoI don't think people consider URL shortening as a security measure, more of a convenience measure. Also, you should bare in mind that many users of such services are not exactly technically savvy (especially compared to the HN crowd, which often gets forgotten here). Given that, if a company is providing URL shortening for their product (such as One Drive), that should be their responsibility to protect the users.
- signal11 11y agoIt's not just about short URLs. Several services, such as Flickr (and IIRC Dropbox), allow you to generate links which allow the recipient of the link to do something (view an album, download a file) without authenticating. This is of course not at all secure, however it is very convenient for sharing stuff with people who don't have an account with the site.