> This is only a lapse in security if you're relying upon URL obfuscation for security to begin with. Which is perfectly reasonable to do: a URL containing a c

> This is only a lapse in security if you're relying upon URL obfuscation for security to begin with. Which is perfectly reasonable to do: a URL containing a cryptographically-secure identifier is itself a cryptographically-secure identifier. An example would be http://foo.invalid/ed2e898ff0b132202cb0bd0dea0d389a7b6439160b9aca5f3edcd99ad34bc2a9 http://foo.invalid/ed2e898ff0b132202cb0bd0dea0d389a7b6439160.... Another example would be OAuth2 bearer tokens, which may be encoded in the URL as a parameter. > It is only actionable if you can MITM or otherwise easedrop and find the graph ID. It looks like the graph IDs are enumerable, rather than being high-entropy, so it looks like you can trawl through the graph looking for interesting objects.