4 ms·
What attacks?
by jesprenj 4y ago
What attacks?
- martin-adams 4y agoMaybe the browser or an extension leaking the URL of the file, which could ultimately get indexed in a search engine.
- jesprenj 4y agoFair point, though search engines are aware of special headers that tell them not to publicize the link to the content. Would it be any safer with the key in the GET parameter string? Search engines still usually treat this string as part of the address.
- Godel_unicode 4y agoAmong other things, it’s almost certainly the case that the web server isn’t implementing a constant-time string comparison for the URL, which enables you to brute-force the value one character at a time.
- jesprenj 4y agoWoah, that sounds interesting, do you have any links to share regarding that issue?