3 ms·
No, this is wrong. Just because it is not a secret does not mean that is disclosure is not valuable. You need that information to compromise it. It narrows all
by sroussey 3y ago
No, this is wrong. Just because it is not a secret does not mean that is disclosure is not valuable. You need that information to compromise it.
It narrows all the possible account IDs to one.
Is that ID already compromised? Can you gain access through someone else that does the work for you?
You can cross reference with other systems you have compromised. Is that account ID in their system? What access does that give you?
Etc, etc. It is not a secret, but it absolutely is valuable.
For example, if you considered it a secret (even though it is not), you might not choose to use third parties that require it, and that can improve your security posture.