Designing a service for password-less temporary access to resources
1–10 of 24 posts
Re: Designing a service for password-less temporary access to resources
#2Each shortcode is 6 characters and is case insensitive. That gives us roughly 1.8 billion (1838265625) combinations.
That's only 1.8 billion combinations if you only have computers talking privately to other computers. But in the scenario outlined in the article, people will see the URL, so you must filter millions of those combinations.
For example, if I come across a recipe for shoo-fly pie, I don't want to forward my grandmother a shortened url like example.com/FuckUG. More importantly, you don't want someone posting a screenshot of your expletive shortcode on social media, or worse.
When wetware is involved, even in just one step, things get messy.
Re: Designing a service for password-less temporary access to resources
#3Each shortcode is 6 characters and is case insensitive. That gives us roughly 1.8 billion (1838265625) combinations. That's only 1.8 billion combinations if you only have computers talking privately to other computers. But in the scenario outlined in the article, people will see the URL, so you must filter millions of those combinations. For example, if I come across a recipe for shoo-fly pie, I don't want to forward…
26^6=308,915,776
36^6=2,176,782,336
Approximate number of words in English: 171,476
Re: Designing a service for password-less temporary access to resources
#4Each shortcode is 6 characters and is case insensitive. That gives us roughly 1.8 billion (1838265625) combinations. That's only 1.8 billion combinations if you only have computers talking privately to other computers. But in the scenario outlined in the article, people will see the URL, so you must filter millions of those combinations. For example, if I come across a recipe for shoo-fly pie, I don't want to forward…
26^6=308,915,776 36^6=2,176,782,336 Approximate number of words in English: 171,476
Are you under the impression that English is the only language with offensive words?
Re: Designing a service for password-less temporary access to resources
#56 characters is pretty trivial to brute force. Someone could set up a script to continuously try all combinations and get access to whatever happens to hit a match.
You could block an IP after a certain number of failures, but that doesn't protect against a network of various IPs attacking (which attackers often have access to). Adding an artificial delay also wouldn't protect against parallel attacks.
A simpler/better solution would be to add a few more characters to the shortcode so it's infeasible to force within your timeframe (and the number of requests your servers can handle in that timeframe).
Re: Designing a service for password-less temporary access to resources
#6I have implemented something similar, but used 12 characters. 6 is way too few for a secure URL
Re: Designing a service for password-less temporary access to resources
#76 characters is pretty trivial to brute force. Someone could set up a script to continuously try all combinations and get access to whatever happens to hit a match. You could block an IP after a certain number of failures, but that doesn't protect against a network of various IPs attacking (which attackers often have access to). Adding an artificial delay also wouldn't protect against parallel attacks. A simpler/bett…
Ug, I imagine someone reading this is going to snowshoe a test over the weekend.
Re: Designing a service for password-less temporary access to resources
#8Two day, 6 char, session id.
Re: Designing a service for password-less temporary access to resources
#9Earlier quoted context omitted.
26^6=308,915,776 36^6=2,176,782,336 Approximate number of words in English: 171,476
Are you under the impression that English is the only language with offensive words?
Are you under the impression that there aren't many, many services which only serve english-speaking populaces, by design, or that even including the offensive words in every language would come close to significantly impacting the entropy involved here?
Re: Designing a service for password-less temporary access to resources
#10Earlier quoted context omitted.
26^6=308,915,776 36^6=2,176,782,336 Approximate number of words in English: 171,476
Are you under the impression that English is the only language with offensive words?
Or that people won't try to find something offensive in a random string... I had a reg plate containing FY...BLX. A friend commented that it spells "fuck you blacks" - didn't even think of reading it like that for years.