3 ms·

But without authentication, there's no way to know if the people who claim to be the people one shared the link with to be the people one actually shared the li

But without authentication, there's no way to know if the people who claim to be the people one shared the link with to be the people one actually shared the link with. Whole-document transformation and copying are a concern, but I think that's usually treated as a different category of issue from "The server I trust to store the data securely gave it up to some anonymous person who passed a correctly-formatted request to it because the server can't know any better."

timothya 12y ago
Yes, certainly this particular bug was serious and a real problem that needed to be fixed. The link should not be shared accidentally like that. I was just making the case that "Anyone with the link" still provides some security. Just like you don't know if the people accessing the document are the ones that you shared the link with, you don't know that the people you shared the document contents themselves with aren't showing others without your knowledge.