4 ms·
This probably isn't a popular opinion, but I fail to see how this is a problem with Facebook. The Google Docs URL is public whether or not you send it through
by thomasfoster96 10y ago
This probably isn't a popular opinion, but I fail to see how this is a problem with Facebook.
The Google Docs URL is public whether or not you send it through Facebook. It's only secret until someone guesses the link (Edit: maybe not mathematically in the case of Google Docs, but many other services use 'unlisted' URLs without having a long token to guess) - something they can do without the URL even going through Messenger.
If you're sharing passwords or confidential information via a public URL with no authentication and hoping nobody finds the address, you're asking for trouble. I don't blame Facebook for not doing anything about it.
- llamataboot 10y agoIt's pretty much mathematically impossible to "guess a link" for a google docs or dropbox URL.
- thomasfoster96 10y agoGoogle Docs maybe - but not every service that uses a similar mechanism.
- balls187 10y agoSuch as?
- thomasfoster96 10y agoYouTube's unlisted videos to name one.
- wolf550e 10y agoA URL with a long random token is unguessable, same as your login token/session token is unguessable.
- KingMob 10y ago> It's only secret until someone guesses the link - something they can do without the URL even going through Messenger. Not really - a sufficiently large random number is effectively unguessable in your lifetime. This is no different than sharing a password with your partner in a private Facebook chat and discovering that outsiders can stumble on it.
- thomasfoster96 10y agoI would say it's quite different to sharing a password as text in Facebook chat - the URL is certainly in your browser history as well as any other place that has logged your GET request.
- jonknee 10y agoSince it's an HTTPS request the GET request won't have the secret bits available for anyone else to see.
- moron4hire 10y agoYour one particular file is effectively unguessable, but that does not mean that guessing at files is a fruitless endeavor.
- GauntletWizard 10y agoNo, actually. It really doesn't take that many bits of entropy for you to be unable to find any documents in a haystack of entries. My file ID is 45 characters of base-64 encoded string. This is a total entropy of 225 bytes. If there are a quintillion files in google drive (a hundred million files per person who has ever lived), you were loading a million possible files per second, you'd still take several times the expected time to the heat death of the universe to randomly stumble upon one.
- doingmyting 10y agoI agree with you. Security by obscurity seems super stupid to me. You deserve to be hacked and have all your secrets exposed. And if you're posting confidential stuff on FB and expecting it to be safe from prying eyes, you're a next level of stupid. But I'm old school, what do I know? I'm just waiting for the day future employers are finding nudes of job candidates off snapchat.