URL shorteners may be exposing your private information by Chris Scott Barr. Further reading: https://freedom-to-tinker.com/blog/...t-urls-considered-harmful-for-cloud-services/
Hi JR, Can I assume that if don't use any of those "services" that my own computer hard drive cannot be accessed using that brute force technique? ---- rich
Rich, never assume anything; you know what that makes us. OTH, given your expertise, your hard drive will not be messed with... unless you want it to be messed with. In all seriousness, their scope of testing was limited to Cloud Services, and Maps. It is reminiscent of using short password lengths, and how easily those can be revealed while being brute forced. The fact that short Google URLs went from 5 to 7 characters tokens to 11 and 12 immediately, plus Microsoft OneDrive stopping the URL shortening option (although prior posted tiny URLs are still vulnerable) all together, inform us how dangerous this shortening technique can be. Whenever we find a tiny URL, Wilders have been replacing them with their longer counterparts for the past 11 years, mainly because thread/post viewers should know where they are being asked to visit. This new revelation makes it imperative that we continue to do so.
From what I understand the files which are being exposed are files hosted on file sharing services such as OneDrive and Google drive. Because the method for shortening URLs was to weak, the researchers could generate valid shortened URL's themselves and as such access random long URLs on which the files are 'hidden'. Imho most articles miss the point. The information was never private to begin with, the fact that you need to know a long URL in order to access it does not negate the fact that the files are publicly available on the internet. If you dig a hole in a public park and bury something secret there, it may be 'private' in the sense that people who don't know where you buried it probably won't find it, but anyone who stumbles across it by accident or starts digging holes everywhere to find it can still easily access it. So to use this example, the researchers knew lots of people buried their secrets in a park, so the researchers just started digging holes on random places and uncovered secrets. The weakness in URL shorteners only lowered the number of digging attempts they needed to do in order to find something.
Yes indeed! Well, I can't imagine creating a URL to access a file on my computer. The only time I've used shortened URLs is in emails where a long URL takes up 4-5 lines that may break in the recipient's email program. I've always appreciated that. thanks, ---- rich
