You cannot simply publicly access private secure links, can you?

Post by layer8 » Thu, Mar 07, 2024, 7:16 PM UTC

internetter wrote: post #5

ta1243 wrote: post #4

Earlier quoted context omitted.

The problem is links leak. In theory a 256 hex-character link (so 1024 bits) is near infinitely more secure than a 32 character username and 32 character password, as to guess it https://site.com/[256chars] As there's 2^1024 combinations. You'd never brute force it vs https://site,com/[32chars] with a password of [32chars] As there's 2^256 combinations. Again you can't brute force it, but it's more likely than the 2^…

Dorking is the technique of using public search engine indexes to uncover information that is presumed to be private. It has been used to uncover webcams, credit card numbers, confidential documents, and even spies. The problem is the website administers who are encoding authentication tokens into URL state, not the naive crawlers that find them.

Post by eterm » Thu, Mar 07, 2024, 7:19 PM UTC

r2b2 wrote: post #56

To create private shareable links, store the private part in the hash of the URL. The hash is not transmitted in DNS queries or HTTP requests. Ex. When links.com?token= is visited, that link will be transmitted and potentially saved (search parameters included) by intermediaries like Cloud Flare. Ex. When links.com# is visited, the hash portion will not leave the browser. Note: It's often nice to work with data in th…

Post by [deleted] » Thu, Mar 07, 2024, 7:22 PM UTC

bombcar wrote: post #57

internetter wrote: post #29

Earlier quoted context omitted.

Where in the article does it suggest this? The two bullet points at the very top of TFA is what I cited to discredit this notion, I read it again and still haven't found anything suggesting the communication platforms are submitting this themselves.

Falcon Sandbox is explicitly mentioned - which is a middleware that can be installed on various communication platforms (usually enterprise): https://www.crowdstrike.com/products/threat-intelligence/fal... Microsoft has "safe links": https://learn.microsoft.com/en-us/microsoft-365/security/off... - Chrome has its own thing, but there are also tons of additional hand-rolled similar features. My main annoyance is when…

Post by nkrisc » Thu, Mar 07, 2024, 7:30 PM UTC

deathanatos wrote: post #70

nkrisc wrote: post #42

Earlier quoted context omitted.

There’s a big difference. The latter requires information not contained in the URL to access the information.

> Here's the URL to the thing: https://example.com/a/url?secret=hunter2 This is indexable by search engines. > Here's the URL to the thing: https://example.com/a/url and the password is "hunter2". This is indexable by search engines. Yes, the latter is marginally harder, but you're still leaning on security through obscurity, here. The number of times I have had "we need to securely transmit this data!" end with exac…

Post by PeterisP » Thu, Mar 07, 2024, 7:38 PM UTC

bachmeier wrote: post #43

internetter wrote: post #2

The fundamental issue is that links without any form of access control are presumed private, simply because there is no public index of the available identifiers. Just last month, a story with a premise of discovering AWS account ids via buckets[0] did quite well on HN. The consensus established in the comments is that if you are relying on your account identifier being private as some form of security by obscurity,…

> The fundamental issue is that links without any form of access control are presumed private, simply because there is no public index of the available identifiers. Is there a difference between a private link containing a password and a link taking you to a site where you input the password? Bitwarden Send gives a link that you can hand out to others. It has # followed by a long random string. I'd like to know if th…