Timeline for Is a long, random string in a URL considered adequate protection from unauthorised access?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 15, 2015 at 18:27 | comment | added | sebastian nielsen | There is accounts in the system for the administrator what I can see, but as the URLs are document-specific (knowing url of document 1 does not give you access to document 2), the system are completely secure. If the page which SERVES the links, is served over forced HTTPS, you are completely safe from sniffing, since even if the HTTPS is not forced on the groupdocs site, the links will not be transferred in cleartext Before you click on them, thus you can avoid compromise by not clicking the links when on a insecure network (for example, wifi). | |
| Mar 15, 2015 at 11:06 | comment | added | Cybergibbons | I mean, if I see a password being sent as a GET or unencrypted POST, that's a serious issue to me. Trying to work out why this is different. | |
| Mar 15, 2015 at 11:05 | comment | added | Cybergibbons | Is audit-ability concern though? The URL is unique per document but there is no concept of account in the system. | |
| Mar 15, 2015 at 10:33 | comment | added | sebastian nielsen | That its a third-party solution. In many contexts, SaaS does rarely have access logging. Yes, the solution have "back-end" logs, but those are not generally available to the "customer" of the service (eg, the one paying for the service). | |
| Mar 15, 2015 at 10:31 | comment | added | Cybergibbons | What does "cloud based" mean in this context? | |
| Mar 15, 2015 at 10:26 | comment | added | sebastian nielsen | No, as long as password is document-unique and not account-unique. Note that normally, cloud-hosted solutions rarely have access logging, so a unique account per user would still not gain anything in auditability compared to "one account per document" model. However, if the url is account-unique, it would be possible to access all documents belongning to a specific user even if you only were given one single document. | |
| Mar 15, 2015 at 10:20 | comment | added | Cybergibbons | If considering it a password, then isn't it a bad idea as everyone accessing the document has the same password? | |
| Mar 15, 2015 at 10:15 | history | answered | sebastian nielsen | CC BY-SA 3.0 |