3 ms·
This is only a lapse in security if you're relying upon URL obfuscation for security to begin with. It is only actionable if you can MITM or otherwise easedrop
by elif 10y ago
This is only a lapse in security if you're relying upon URL obfuscation for security to begin with. It is only actionable if you can MITM or otherwise easedrop and find the graph ID.
Title rating: unreasonably alarmist
- balls187 10y agoI'd say the lapse is using guessable numeric id's, rather than sparse guids.
- dang 10y agoWe've changed the title to (what appears to be) a representative sentence from the article.
- zeveb 10y ago> This is only a lapse in security if you're relying upon URL obfuscation for security to begin with. Which is perfectly reasonable to do: a URL containing a cryptographically-secure identifier is itself a cryptographically-secure identifier. An example would be http://foo.invalid/ed2e898ff0b132202cb0bd0dea0d389a7b6439160b9aca5f3edcd99ad34bc2a9 http://foo.invalid/ed2e898ff0b132202cb0bd0dea0d389a7b6439160.... Another example would be OAuth2 bearer tokens, which may be encoded in the URL as a parameter. > It is only actionable if you can MITM or otherwise easedrop and find the graph ID. It looks like the graph IDs are enumerable, rather than being high-entropy, so it looks like you can trawl through the graph looking for interesting objects.