Is this a security risk? Could someone, theoretically, enter in a random string of characters and land on your files?
Dropbox Forums: New Sharing Model
11–20 of 40 posts
Re: Dropbox Forums: New Sharing Model
#12Is this a security risk? Could someone, theoretically, enter in a random string of characters and land on your files?
I'd have to go with yes. Hate to be an entropy nazi, but here goes:
Hash is 6 characters long, characters are alphanumeric (a-zA-Z0-9). So that makes:
(26 * 2 + 10) ** 6 => 5.6E10
( (26 * 2 + 10) ** 6 ) / 10_000_000 => 5680
Note that the links redirect to a page with a far longer (and presumably far more secure) hash code. Any time when you see short hash -> longer hash alarm bells should go off.
I'm assuming the share links last forever. If the share links would last only 24 hours then system looks pretty safe.
Anyway, this is only my first impression. I might very well be wrong. Either way I think it's pretty silly to give up so much entropy to get a prettier URL. Why not just use the complete 128bit hash?
Re: Dropbox Forums: New Sharing Model
#13Is this a security risk? Could someone, theoretically, enter in a random string of characters and land on your files?
No, you still choose which files and folders to make linkable.
Anything you give a url to you should consider to be public anyway.
Re: Dropbox Forums: New Sharing Model
#14I bet with the public launch, they will put bandwidth restrictions in place. Otherwise this will be misused in no time.
Re: Dropbox Forums: New Sharing Model
#15Dropbox has a music player now?
Re: Dropbox Forums: New Sharing Model
#16Is this a security risk? Could someone, theoretically, enter in a random string of characters and land on your files?
No, you still choose which files and folders to make linkable. Anything you give a url to you should consider to be public anyway.
Still a good analysis of using the security by obscurity model for URL's
Re: Dropbox Forums: New Sharing Model
#17Important point: Any file or folder in your Dropbox is now linkable! But not quite yet, presumably very soon. Apparently appears in the 0.8 beta clients only, didn't see anything specific about the website (though I don't see it on my account).
If you're feeling bold, here's a link to the experimental build:
Re: Dropbox Forums: New Sharing Model
#18Is this a security risk? Could someone, theoretically, enter in a random string of characters and land on your files?
I'd have to go with yes. Hate to be an entropy nazi, but here goes: Hash is 6 characters long, characters are alphanumeric (a-zA-Z0-9). So that makes: (26 * 2 + 10) ** 6 => 5.6E10 That looks like a big number, but it isn't. Because at the scale of dropbox there will be 10 million links out there in no time. So then the math goes: ( (26 * 2 + 10) ** 6 ) / 10_000_000 => 5680 So you have to make only a few thousand gues…
I haven't used the feature yet, but from reading the forum thread it sounds like the 6 random characters are only created if someone chooses to shorten their link with db.tt (presumably Dropbox's shortener). By default, resources have 15 random characters. Since URL shortening is mostly for use with twitter, I think the number of non-public files/folders with a corresponding 6-random-character link will not approach 10MM any time soon.
Re: Dropbox Forums: New Sharing Model
#19Is this a security risk? Could someone, theoretically, enter in a random string of characters and land on your files?
No, you still choose which files and folders to make linkable. Anything you give a url to you should consider to be public anyway.
I think you're overstating the risks of random URLs. Unlisted cell phone numbers are not considered public even though you give them to all your friends and to every nearby cell tower. Credit cards are not considered public even though you might hand yours to a lot of strangers.
Re: Dropbox Forums: New Sharing Model
#20Is this a security risk? Could someone, theoretically, enter in a random string of characters and land on your files?
No, you still choose which files and folders to make linkable. Anything you give a url to you should consider to be public anyway.
By default all my folders are linkable.
Can you tell us how to change that?