7 ms·
I worked with an org that ran their own link shortener... and used it for confirmation links! I'm not even kidding, you'd go to reset you password and as expect
by chias 5y ago
I worked with an org that ran their own link shortener... and used it for confirmation links! I'm not even kidding, you'd go to reset you password and as expected the link would be something like:
ourapp.example.com/auth/reset?user=blah&token=1af17e73721dbe0c40011b82ed4bb1a7dbe3ce29eae4997c84600287f8866673d05fdaa1aa841a5a
and they they figured, oh man, those links are unsightly for email, we'd best turn that into something like:
ourapp.example.com/s/xO8pR
That looks way cleaner in an email.
- sonograph 5y ago> ourapp.example.com/s/xO8pR Wow. And makes it easier to brute-force (Which I think you're insinuating). If the links have an auto-expire of 10 minutes, is the risk sufficiently mitigated? Or am I missing something else?
- fullstop 5y agoRequire the user to enter their user id again.
- nneonneo 5y ago…and make sure that the original URL doesn’t include the user ID anywhere - it did in OP’s original example, which means that any attacker could scrape the ID just by watching what the redirect went to (assuming a normal link shortening service was used)
- fullstop 5y agoRight, that was implied. You'd need to rate-limit the shortened URL endpoint as well or increase the number of characters. Without it, you could reset a user's password and brute force all shortened possibilities while entering their username. There'd be enough red flags to identify and stop this type of behavior, I think.
- chias 5y agoWouldn't help much with it right there in the URL too. Even if it weren't, triggering a password reset for somebody and then fuzzing the url space ends up working pretty quick. I saw a few comments talking about rate limiting but since these are by definition unauthenticated requests, that's not going to help you either. Short version (heh) is you cannot make this secure.
- fullstop 5y agoClearly the user id would be removed from the URL, and rate limiting can be done by IP address.
- dheera 5y agoAlso, I never click on links in e-mails directly. For something like this I'd cut and paste the address it seems Google puts another layer of redirection in Gmail to spy on you ("data-saferedirecturl", whatever that does in their JS)
- sneak 5y agoIt's a valve they can shut off when the targets are detected to be phishing or malware, so the link breaks. And, of course, tracking.
- dheera 5y agoSince they control the rendering, they can shut it off by not hyperlinking the link or displaying a warning next to it, they don't need to put an always-on tracking mechanism in place that sends them click data even when the link is not determined to be malware.
- Telemakhos 5y agoI imagine that many organizations would like to know which of their employees did click a link that turns out to be malicious, so that the company can check those employees' computers for malware. Tracking could be useful for determining the severity of the damage done by a successful phishing attack.
- dheera 5y agoFor corporations on corporate computers fine, but this is Google tracking personal accounts.
- gowld 5y agoGmail can track when you cut the URL...
- eeegnu 5y ago
- mediumdeviation 5y agoI hope you've managed to fix this, because this is an obvious security issue. A long token is used precisely because it is long and unguessable. The shortened URL is subject to enumeration attacks which can be used to hijack accounts.
- ______- 5y ago> A long token is used precisely because it is long and unguessable This. So much fun can be had by enumerating link shortener URLs. I've experimented with enumerating some services' URL schema. Most of the time the link pointed to innocuous things like Amazon affiliate links or whatnot. Sometimes you would find interesting content that made you go 'wow!', but that was very rare.
- chias 5y agoYeah. When I stumbled across this I had some conversations, with the net result that URLs containing authenticator tokens are no longer shortened :)
- jedberg 5y ago> because this is an obvious security issue Not really. Usually password reset tokens are only valid for 10 or 15 minutes. With some basic rate limiting, you can stop a single actor from accessing more than one of those links in 15 minutes. And even if they work around that, you just ask the user to verify their email address when they click on the link. Being able to enumerate the reset tokens and guess the right email address at the same time is highly unlikely.
- jonny_eh 5y agoI doubt they implemented rate limiting though.
- read_if_gay_ 5y agoHere’s some more baseless guesswork: I am absolutely certain they did.
- fullstop 5y agoI'm not sure if this is still the case but there was a period of time when email clients would not transform the entire URL into a clickable link if it was too long. These were generally email clients which supported plain text only. Anyway, I think that I'd be okay with a shortener like your example as long as it: 1. Required me to enter my user id again 2. Was only valid for 30 minutes
- mattowen_uk 5y agoOutlook desktop client still has problems with really long links in that although they remain clickable, they don't actually go anywhere.
- kbelder 5y agoYeah, we do that. It's simple and easy, allows us to tweak the destination of a published link if the site shuffles, lets us print simple short links that are quick to type but still are obviously our own domain. You can't do it for everything... for one thing, you don't gain search engine karma from the links. But it's often very useful.
- andruby 5y agoDo you also do that for links with secret tokens like the reset password link the op mentioned? Because -spoiler- that makes those links very easy to guess/brute force
- kbelder 5y agoNo, I should have made that clear. Don't do it for links including tokens, user accounts, or anything like that. (Obviously.) Only on links you'd put out for mass consumption. Still, it can eliminate lots of unsightly cruft in a link. It can replace this: https://thisonecompany.com/productinfo/specs/?sku=sdfdf432&format=detail https://thisonecompany.com/productinfo/specs/?sku=sdfdf432&f... with: https://this.co/proddeets https://this.co/proddeets
- zzyzxd 5y agoThere are many valid use cases for URL shortener, I am not sure if this is one of them. IMHO, this is a display layer issue that only affects human eyes, and should be handled on display layer (html, email rendering...etc) -- just don't display the whole URL somehow. Machines won't have any problem processing that long link.
- jkaptur 5y agoSome platforms do this. My understanding is that they're especially motivated by the fact that many people don't really distinguish between mybank.com/changepassword and mybank.attacker.com/changepassword. However, it really infuriates some vocal technical folks (e.g. https://www.androidpolice.com/2020/08/13/google-resumes-its-senseless-attack-on-the-url-bar-hides-full-addresses-on-chrome-canary/ https://www.androidpolice.com/2020/08/13/google-resumes-its-...). I think the compromise is good: hide the full URL by default, but have a setting or some affordance to show the full thing to people who do enjoy looking at it.
- natdempk 5y agoThe first link is a hex encoded token, 80 chars, 4 bits per char = 320 bits of information. The second shortened link key is likely base 64 encoded, 5 chars, 64 bits per char = 320 bits of information. These should be basically the same from a security perspective. Is there something I'm missing here that you're suggesting? Edit: This is wrong and should be 30 bits of information not 320 bits for the shortened form. 64 values = 6 bits not 64 bits.
- niklasbuschmann 5y agobase64 -> 64 possibilities -> 6 bits I guess?
- wizzwizz4 5y ago> The second shortened link key is likely base 64 encoded, 5 chars, 64 bits per char No, 64 values – or 6 bits. 6×5=30, not 320.
- natdempk 5y agoAh, RIP, my math is incorrect. Thanks.
- deleted 5y ago[deleted]
- joombaga 5y agoI think it's usually base62.
- ______- 5y agohttps://www.kerstner.at/2012/07/shortening-strings-using-base-62-encoding/ https://www.kerstner.at/2012/07/shortening-strings-using-bas...
- rascul 5y agoProbably is. Base64 includes + and / which I believe need to be URL encoded, plus the = padding can mean an extra step if you want to remove them to make the URL pretty. https://en.wikipedia.org/wiki/Base64#Base64_table https://en.wikipedia.org/wiki/Base64#Base64_table