3 ms·

>Quickly send passwords, credit card numbers, and other sensitive information safely. Your data is encrypted and can only be decrypted when viewed using your pr

>Quickly send passwords, credit card numbers, and other sensitive information safely. Your data is encrypted and can only be decrypted when viewed using your private link. Am I missing something here? "Your private link" is what you pass around for others to download see the linked to document/data. Anyone who has the link (or is first to use it) has your password/sensitive data.

ToastyMallows 12y ago
Nope you're not missing anything. The longer you wait to use the URL, the less secure it is. I could just generate a bunch of random URLs and wget them until I get something.
- bobwaycott 12y ago
  > The longer you wait to use the URL, the less secure it is. Potentially true if you've chosen to upload with the 'one download' expiry time set, and then whomever you've shared the link with does not use it within 30 days (at which point it is expired & deleted). With the 'two days' option, the link does not become less secure than it was at generation because it (and the content) is deleted forever after 48 hours.
- dbpatterson 12y ago
  Take a look at the urls and do some calculation on how likely you are to actually get anything. It looks like 14 characters, alphanumeric with uppercase, which is about 10^25. Even if you can try a thousand urls per second, that would take you about 10^16 days to go through them all (that's a long time). Or, if you want to calculate probabilities, assume that a billion urls are used (this is an astronomic overestimate). That's 10^9 urls. The chance of hitting one of those with a random guess is 0.00000000000014% (if I counted the 0s right). Not very likely. Now if the url is observed in transit - that's a completely different thing. Just don't think that random guessing is going to reveal this. It's similar to people thinking you can guess your way to product keys for software (hint: you can't).
brianmwaters_hn 12y ago
I don't think you're missing anything. That's the same idea I got. There's no mention of authentication or encryption, whatsoever. Other than the obvious problems with putting plaintext secrets at a publicly-accessible URL, the whole security model seems to be "we promise to delete your stuff, trust us." I find it really ironic that this is coming out right after the whole Snapchat scandal. (This is like Snapchat for documents.)
nwah_ 12y ago
Hi njharman, I'm one of Torpedo's devs. No, you're not missing anything. We built Torpedo to be a step-up from the way most of our clients and other people we worked with sent us stuff: files via Cloud links that sit around forever, and passwords in emails. There are certainly more secure ways to send both of those things than Torpedo, but we wanted to make something that was more secure to send those things, while keeping it just as (or more) convenient. We've got a few ideas that we're considering that'll offer more security, just trying to sort out how to keep it simple enough for our parents to use it.
- dublinben 12y ago
  I think you really need to look at what Citrix is doing with their Sharefile service. It's a secure cloud sharing service that has significant uptake in the professional services industries. It offers all of your features and more.
bobwaycott 12y ago
The link also expires (and is deleted forever) after one visit or two days, whichever you choose upon uploading the content to share.

ToastyMallows 12y ago

Nope you're not missing anything. The longer you wait to use the URL, the less secure it is. I could just generate a bunch of random URLs and wget them until I get something.

bobwaycott 12y ago
> The longer you wait to use the URL, the less secure it is. Potentially true if you've chosen to upload with the 'one download' expiry time set, and then whomever you've shared the link with does not use it within 30 days (at which point it is expired & deleted). With the 'two days' option, the link does not become less secure than it was at generation because it (and the content) is deleted forever after 48 hours.
dbpatterson 12y ago
Take a look at the urls and do some calculation on how likely you are to actually get anything. It looks like 14 characters, alphanumeric with uppercase, which is about 10^25. Even if you can try a thousand urls per second, that would take you about 10^16 days to go through them all (that's a long time). Or, if you want to calculate probabilities, assume that a billion urls are used (this is an astronomic overestimate). That's 10^9 urls. The chance of hitting one of those with a random guess is 0.00000000000014% (if I counted the 0s right). Not very likely. Now if the url is observed in transit - that's a completely different thing. Just don't think that random guessing is going to reveal this. It's similar to people thinking you can guess your way to product keys for software (hint: you can't).

brianmwaters_hn 12y ago

I don't think you're missing anything. That's the same idea I got. There's no mention of authentication or encryption, whatsoever. Other than the obvious problems with putting plaintext secrets at a publicly-accessible URL, the whole security model seems to be "we promise to delete your stuff, trust us." I find it really ironic that this is coming out right after the whole Snapchat scandal. (This is like Snapchat for documents.)

nwah_ 12y ago

Hi njharman, I'm one of Torpedo's devs. No, you're not missing anything. We built Torpedo to be a step-up from the way most of our clients and other people we worked with sent us stuff: files via Cloud links that sit around forever, and passwords in emails. There are certainly more secure ways to send both of those things than Torpedo, but we wanted to make something that was more secure to send those things, while keeping it just as (or more) convenient. We've got a few ideas that we're considering that'll offer more security, just trying to sort out how to keep it simple enough for our parents to use it.

dublinben 12y ago
I think you really need to look at what Citrix is doing with their Sharefile service. It's a secure cloud sharing service that has significant uptake in the professional services industries. It offers all of your features and more.

bobwaycott 12y ago

The link also expires (and is deleted forever) after one visit or two days, whichever you choose upon uploading the content to share.