Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker) [LWN.net]

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 14, 2016 20:59 UTC (Thu) by noahm (subscriber, #40155)
Parent article: Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

The difference in tone of the responses from Google and Microsoft, when informed of this problem with their services, is really interesting. One of these companies either didn't comprehend the significance of the problem or didn't take seriously the threat to their users. The other fixed the problem promptly, and is working on additional defenses for the future.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 6:10 UTC (Fri) by eru (subscriber, #2753) [Link] (1 responses)

In one sense MS is right: the attack works because the URLs are short, and making short URLs is the whole point of URL shorteners. I suspect you would need something like 20 characters to make brute-forcing infeasible today, and the minimum length would grow over time.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 14:28 UTC (Fri) by khim (subscriber, #9252) [Link]

I don't really see why. Note that we are NOT talking about some arbitrary functions which you could calculate locally. Rather we talk about something you need to ask remote server about!

Which means that if server responds fast enough to make human reader happy but not fast enough to make brute-force attack feasible... then that's it: fast computers and ASICs wouldn't change anything for that equations.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 6:51 UTC (Fri) by epa (subscriber, #39769) [Link] (8 responses)

Hasn't it always been a tenet of the Web that relying on keeping a URI 'secret' is doomed?
If you have sensitive information to protect, don't rely on others not being able to guess the URI; protect it with a password or other authentication mechanism instead.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 7:26 UTC (Fri) by tao (subscriber, #17563) [Link]

Indeed. If there really are services that rely on the URI for security, then those services are flawed -- URI shortening or not.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 7:28 UTC (Fri) by DOT (subscriber, #58786) [Link] (2 responses)

The URI is a red herring in this case, since you can consider it the password. The real problem is that the password was too short.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 9:06 UTC (Fri) by epa (subscriber, #39769) [Link] (1 responses)

That's what I am saying. Treating the URI as a password and trying to keep it 'secret' is a flawed approach. Accept that the URI can be found out by anyone who does a bit of digging, and if you have sensitive information to protect, use a password or other authentication to protect it.

A longer URI would be harder to find by brute force, but that is only a sticking plaster for the problem, since it will still turn up in Referer: headers and so on.

That said, it is certainly true that the insecure approach is usually the more convenient one, and passing around URIs which don't require any further login details is always going to beat any other approach in convenience. So a sticking plaster may be the best we can do at the moment. If everyone in the world had a Google account then it would be trivial to 'share these driving directions with the following users...' but, thank goodness, the world is more messy than that.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 11:10 UTC (Fri) by alonz (subscriber, #815) [Link]

It actually is quite common to have a URI act as a password: just look e.g. at the URIs for Google photos.

And there is good reason for this practice—it enables the photo owner to share it with friends without them having to sign in. So sure, it's limited (if the URI leaks, it's usable by anyone) but it is a valid trade-off.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 10:43 UTC (Fri) by niner (guest, #26151) [Link] (3 responses)

So how exactly can I password protect the Google Maps route I'm sending to someone?

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 11:25 UTC (Fri) by NAR (subscriber, #1313) [Link] (2 responses)

I think there's an option to share it with only specific Google Maps users (i.e. with those who have a Google account).

What I don't quite understand is how do they know who created that map?

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 19:33 UTC (Fri) by cwitty (guest, #4600) [Link] (1 responses)

"What I don't quite understand is how do they know who created that map?"

If you're talking about the geocacher map, the researchers created the map as a summary of hundreds of sets of driving directions, all starting at one particular residential address. So it seems reasonable to assume that the person who requested all of those driving directions lives at that address.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 17, 2016 20:41 UTC (Sun) by pr1268 (guest, #24648) [Link]

So it seems reasonable to assume that the person who requested all of those driving directions lives at that address.

Either that, or the researchers stumbled upon someone's malicious prank to inundate said address with dozens of unwanted visitors.

Okay, I'm being a little facetious here, but it could happen!