I put it through a password complexity tester at http://howsecureismypassword.net/ and the result was "It would take a desktop PC about 802 vigintillion years to crack your password". (That seems to be a pretty long time).

That, of course, assumes a random password, which isn't likely the case here. There is almost certainly an algorithm creating these document ID's and if the algorithm can be guessed, that certainly ups the odds that someone can guess the ID's.

Also, no "password strength" tool is perfect. That time is a guess by one system that likely makes assumptions that may or may not be valid. The point of posting it was just as a baseline "Not knowing anything else, how hard would it be to brute-foorce this?"

But in and of itself, guessing the ID of a particular ID associated with a particular account would be exceedingly difficult. An attacker would need to be logged in as someone that has access to a specific document, which lowers the risk considerablly.

I put it through a password complexity tester at http://howsecureismypassword.net/ and the result was "It would take a desktop PC about 802 vigintillion years to crack your password". (That seems to be a pretty long time).

That, of course, assumes a random password, which isn't likely the case here. There is almost certainly an algorithm creating these document ID's and if the algorithm can be guessed, that certainly ups the odds that someone can guess the ID's.

Also, no "password strength" tool is perfect. That time is a guess by one system that likely makes assumptions that may or may not be valid. The point of posting it was just as a baseline "Not knowing anything else, how hard would it be to brute-force this?"

But in and of itself, guessing the ID of a particular ID associated with a particular account would be exceedingly difficult. An attacker would need to be logged in as someone that has access to a specific document, which lowers the risk considerably.

Assuming the permissions portion of Google Docs is solid: Only people that you have granted permissions to view the document actually can access it. From that, it is likely that a logged in user could only brute-force documents that they already have permissions to already.

The complexity of the ID isn't the only security tool, it's a layer of obscurity on top of the already-existing security. It may be security by obscurity in one sense, but it's not the sole factor. Security by obscurity is bad only when it's the only measure of defense. If it adds complexity onto the task there is no harm in it, and it can certainly slow an attacker down. It's just not safe to rely on it as your only defense.

I put it through a password complexity tester at http://howsecureismypassword.net/ and the result was "It would take a desktop PC about 802 vigintillion years to crack your password". (That seems to be a pretty long time).

That, of course, assumes a random password, which isn't likely the case here. There is almost certainly an algorithm creating these document ID's and if the algorithm can be guessed, that certainly ups the odds that someone can guess the ID's. But in and of itself, guessing the ID of a particular ID associated with a particular account would be exceedingly difficult. An attacker would need to be logged in as someone that has access to a specific document, which lowers the risk considerablly.

I put it through a password complexity tester at http://howsecureismypassword.net/ and the result was "It would take a desktop PC about 802 vigintillion years to crack your password". (That seems to be a pretty long time).

That, of course, assumes a random password, which isn't likely the case here. There is almost certainly an algorithm creating these document ID's and if the algorithm can be guessed, that certainly ups the odds that someone can guess the ID's.

Also, no "password strength" tool is perfect. That time is a guess by one system that likely makes assumptions that may or may not be valid. The point of posting it was just as a baseline "Not knowing anything else, how hard would it be to brute-foorce this?"

But in and of itself, guessing the ID of a particular ID associated with a particular account would be exceedingly difficult. An attacker would need to be logged in as someone that has access to a specific document, which lowers the risk considerablly.