3 ms·
Author here. I think you missed the nuance I was going for. I use YouTube and AWS as example since they both have implementations that are vulnerable to IDOR,
by 8organicbits 1y ago
Author here. I think you missed the nuance I was going for.
I use YouTube and AWS as example since they both have implementations that are vulnerable to IDOR, but I think they made the right call. Sometimes usability takes preference over security. Sometimes 'obfuscation' is better than proper authorization.
> There are use cases where the effort needed to individually grant users access outweighs the risk of using unlisted. Not everyone is dealing in highly sensitive content, after all.