2 ms·
A good example of #3 are public share links. Things are more secure if you share your file with a specific set of users, but that requires your counterpart to
by pbronez 2y ago
A good example of #3 are public share links.
Things are more secure if you share your file with a specific set of users, but that requires your counterpart to have an account with the system you’re using (eg a Google Account for Google Drive). When sharing files with an arbitrary counterparty, it’s often sufficient to generate a publicly available, unlisted/unindexed, hard to guess URL. Even better if it’s time boxed.
I’m sure there are attackers who attempt to identify and enumerate these URLs. If they’re well designed though, it should be infeasible to guess the link.
- walterbell 2y ago> it’s often sufficient to generate a publicly available, unlisted/unindexed, hard to guess URL Unless a service is leaking or spidering the URL into a public index. https://positive.security/blog/urlscan-data-leaks https://positive.security/blog/urlscan-data-leaks https://arstechnica.com/information-technology/2014/05/dropbox-disables-old-shared-links-after-tax-returns-end-up-on-gooogle/ https://arstechnica.com/information-technology/2014/05/dropb... https://security.stackexchange.com/questions/239762/how-are-hidden-private-urls-being-leaked-to-third-parties https://security.stackexchange.com/questions/239762/how-are-...
- avidiax 2y agohttps://gizmodo.com/cia-websites-reportedly-led-to-the-exposure-of-critical-1849601326 https://gizmodo.com/cia-websites-reportedly-led-to-the-expos... It is much harder than it would seem to keep these links secret. If one of your assets gets caught by other means, they could endanger the entire network if they use the same methodology. The CIA thought they had a super great system, and then many of their assets got rolled up at once in a hugely embarrassing (and deadly) blunder.