Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker) [LWN.net]

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 6:51 UTC (Fri) by epa (subscriber, #39769)
In reply to: Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker) by noahm
Parent article: Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Hasn't it always been a tenet of the Web that relying on keeping a URI 'secret' is doomed?
If you have sensitive information to protect, don't rely on others not being able to guess the URI; protect it with a password or other authentication mechanism instead.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 7:28 UTC (Fri) by DOT (subscriber, #58786) [Link] (2 responses)

The URI is a red herring in this case, since you can consider it the password. The real problem is that the password was too short.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 9:06 UTC (Fri) by epa (subscriber, #39769) [Link] (1 responses)

That's what I am saying. Treating the URI as a password and trying to keep it 'secret' is a flawed approach. Accept that the URI can be found out by anyone who does a bit of digging, and if you have sensitive information to protect, use a password or other authentication to protect it.

A longer URI would be harder to find by brute force, but that is only a sticking plaster for the problem, since it will still turn up in Referer: headers and so on.

That said, it is certainly true that the insecure approach is usually the more convenient one, and passing around URIs which don't require any further login details is always going to beat any other approach in convenience. So a sticking plaster may be the best we can do at the moment. If everyone in the world had a Google account then it would be trivial to 'share these driving directions with the following users...' but, thank goodness, the world is more messy than that.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 11:10 UTC (Fri) by alonz (subscriber, #815) [Link]

It actually is quite common to have a URI act as a password: just look e.g. at the URIs for Google photos.

And there is good reason for this practice—it enables the photo owner to share it with friends without them having to sign in. So sure, it's limited (if the URI leaks, it's usable by anyone) but it is a valid trade-off.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 10:43 UTC (Fri) by niner (guest, #26151) [Link] (3 responses)

So how exactly can I password protect the Google Maps route I'm sending to someone?

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 11:25 UTC (Fri) by NAR (subscriber, #1313) [Link] (2 responses)

I think there's an option to share it with only specific Google Maps users (i.e. with those who have a Google account).

What I don't quite understand is how do they know who created that map?

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 15, 2016 19:33 UTC (Fri) by cwitty (guest, #4600) [Link] (1 responses)

"What I don't quite understand is how do they know who created that map?"

If you're talking about the geocacher map, the researchers created the map as a summary of hundreds of sets of driving directions, all starting at one particular residential address. So it seems reasonable to assume that the person who requested all of those driving directions lives at that address.

Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

Posted Apr 17, 2016 20:41 UTC (Sun) by pr1268 (guest, #24648) [Link]

So it seems reasonable to assume that the person who requested all of those driving directions lives at that address.

Either that, or the researchers stumbled upon someone's malicious prank to inundate said address with dozens of unwanted visitors.

Okay, I'm being a little facetious here, but it could happen!