4 ms·
Except Microsoft is kinda right: it is not a security vulnerability. If somebody can access given url just by guessing it — well, it it unprotected, so implicit
by krick 11y ago
Except Microsoft is kinda right: it is not a security vulnerability. If somebody can access given url just by guessing it — well, it it unprotected, so implicitly it is supposed to be accessed by anyone. No matter how long it is. I could've found it via google, you might have exposed it by sending it via email/skype/whatever. For what it's worth I can bruteforce 12-character urls as easily: if you don't know where do you want to get, it doesn't matter which road you take, so as long as I get at least some valid urls by random guessing — it is virtually as insecure, as if every url would be valid.
Praising google and blaming microsoft on that is actually stupid and harmful — this "concerned about security" image is nothing but marketing move for naïve people. If shortened urls are twice as long as before, does it mean that now it's safe to have some confidential information assigned to them left without authentication? I bet it doesn't. But it sort of implies so. The url shortening service just got worse, by being twice less efficient in what it's supposed to do: shorten urls. But not more safe, not at all.
- tetrep 11y ago> If somebody can access given url just by guessing it — well, it it unprotected, so implicitly it is supposed to be accessed by anyone. No matter how long it is. Let's see what happens when we apply this logic to cryptography... If somebody can access you data just by guessing it's key — well, it it unprotected, so implicitly it is supposed to be accessed by anyone. No matter how long the key is.
- krick 11y agoExcept you don't expose passwords to the third party (and bit.ly, email provider and stuff all are third parties), and if you do — it's your fault you've got fucked. And you can chose arbitrary length key or password, and do not get randomly generated 6/12 char password for you. And, uh, I almost forgot, passwords are supposed to protect some information, and urls are supposed to show somebody the road to where this information is stored. It's pretty much by definition, if you unwrap the abbreviature. That's why you have logins and passwords in the first place, not just longer logins: the first is supposed to be public (to be shared if need to be) and is used to access some resource, and the second is supposed to be kept private and is used to authenticate that access. And url shorteners are supposed to make urls short and nothing more. And in fact your comment and the fact that you think these things are comparable is exactly what is dangerous about the situation, and not the damn short urls themselves. It's like some guys forcing drillmakers to start making drills out of rubber, because some idiot tried to pick his teeth with turned-on drill and got killed. See how dangerous drills are! Well, yeah, they are pretty dangerous, but how about just not picking your teeth with the fucking drill, and not applying "toothpicking logic to drillmaking"? By the way, the guy with rubber drill still can kill himself with that — it's just less efficient for both drilling wood and killing idiots. Exactly like what it is with "longer shortened urls.