We need to host files in Azure Blob Store, and allow access to end users to their generated "statements"(pdf) for a short period of time.
We're considering achieving this by generating a short-lived SAS token and sending that to the user (this user may be anyone on the internet, hence "untrusted").
Are SAS tokens safe enough? They are HMAC-SHA256 tokens, so I'm not sure if a person could try figure out our genuine secret account key by brute-force (i.e. generating tokens with random keys until a key matches the hmac-sha256 signature).