Gone In Six Characters: Short URLs Considered Harmful for Cloud Services (Freedom to Tinker)

That's what I am saying. Treating the URI as a password and trying to keep it 'secret' is a flawed approach. Accept that the URI can be found out by anyone who does a bit of digging, and if you have sensitive information to protect, use a password or other authentication to protect it.

A longer URI would be harder to find by brute force, but that is only a sticking plaster for the problem, since it will still turn up in Referer: headers and so on.

That said, it is certainly true that the insecure approach is usually the more convenient one, and passing around URIs which don't require any further login details is always going to beat any other approach in convenience. So a sticking plaster may be the best we can do at the moment. If everyone in the world had a Google account then it would be trivial to 'share these driving directions with the following users...' but, thank goodness, the world is more messy than that.