-1

Maybe my math is wrong, but here it goes.

If I generate a private url to share an album in Google Photos, I get something like this

https://photos.app.goo.gl/*****************

where the asterisks are alphanumeric characters, case sensitive (total of 62 possible characters). The length of the secret part of the url is 17 characters long.

My calculations tell me I get around 7*10^14 possible combinations. With a brute force approach, at a rate of 10 million attempts per second, I could get a list of all valid URLs of Google Photos in less than 3 years.

This doesn't seem unguessable to me. Sure, my specific URL is still one in many valid URLs, but then anyone could browse through any private albums.

Where is my logic flawed?

Improve this question
5
  • 1
    1. Who said they were supposed to be "unguessable"? 2. URLs don't stay valid forever. 3. And people can't browse through your private albums, but only those links that are marked for public view... You have a ton of unexamined assumptions here before we get to the math.
    – schroeder ♦
    Sep 10, 2021 at 11:25
  • 4
    I'm not sure how you're going to manage 10 million requests per second to google's servers. Also, 62^17≈3*10^30, which is pretty much unguessable.
    – nobody
    Sep 10, 2021 at 11:26
  • 6
    Your math is off. If you have 17 characters chosen from 62 possibilities and allowing repeats, you get 62^17 which is about 10^30. At 10M/s guesses, you need 10^15 years,
    – Marc
    Sep 10, 2021 at 11:27
  • @Marc: Yep, math is off, as I commented in an answer below. Sorry guys :(
    – cinico
    Sep 10, 2021 at 12:02
  • 1
    Um, guys? If the search space is only 10^2 or even 1^1, it doesn't change the answer about protecting private albums or private URLs. If the answer is "math", then you've asked the wrong question.
    – schroeder ♦
    Sep 10, 2021 at 12:11

2 Answers 2

Reset to default
2

First, your calculations are way off. 6217 is about 1030.

at a rate of 10 million attempts per second

Here is another problem. You cannot throw 10 million requests per second at Google without being blocked even before the first second ends. Google will surely find the behavior strange and throw in a Captcha for you. And good luck solving 10 million Captcha challenges per second.

And even if you could achieve that rate, you would need 2.2*1017 years to guess them all. To do that in 3 years you would need to ramp up the rate to a little bellow 1024 requests per second.

I hope you have unlimited bandwidth and free electricity.

Improve this answer
2
  • I thought about the limitation of requests to Google servers, but decided to ignore it for now. Where I went wrong, indeed, was in the calculation of the number of combinations - I calculated for the case where the order wouldn't matter (nCr, n=62, r=17). Thanks for noticing the mistake and for answer.
    – cinico
    Sep 10, 2021 at 11:59
  • 1
    It has nothing to do with the size of the search space ... or how long it might take. It's not about math at all.
    – schroeder ♦
    Sep 10, 2021 at 12:02
1

Let me flip your entire approach (and logic) around.

Because you know the search space, 6217, you already know all the URLs.

What you want to know is which of those URLs return content.

So, sure, you could ping each one and look for image files being returned, and you could create a list of all URLs with pictures.

But you can't do that at 10 million hits per second. You have traffic, bandwidth, and server response times to deal with before we get to any rate limiting imposed by the brute force. I think you used really high offline hash cracking stats (e.g. hashcat), which doesn't apply here because you are waiting on a server.

But, let's assume that they don't rate limit. And let's assume that you can hit the search space 10 million times a second. Heck, let's go crazy and say that we can hit it 10 trillion times a second!

What do you get? All the URLs that you have permission to view.

Your question states,

"anyone could browse through any private albums".

No. Google Photos has an authentication layer. So, I can know the URL to your private photo, but unless they are marked as public or shared with me, how am I supposed to view that content? Google's authentication layer blocks me.

Improve this answer
8
  • 1
    OP is asking about the urls created for sharing. There is no authentication layer on those.
    – nobody
    Sep 10, 2021 at 12:38
  • ... then they are not private ... they have been marked as "Public". When you create a link it says before you even get the link "Let anyone with the link see photos and people in this album."
    – schroeder ♦
    Sep 10, 2021 at 12:38
  • 1
    Yes, but... people would normally assume that only the people who have that link would be able to access the photos. After all, the UI for creating the link for sharing doesn't say, "this will share your photo with the entire internet".
    – nobody
    Sep 10, 2021 at 12:41
  • And they have a whole "share with individuals" option. If the unexamined assumption is "only people I send the link to can view the file", then that's the answer and the thing to address. Not the math around the search space.
    – schroeder ♦
    Sep 10, 2021 at 12:44
  • 1
    @schoeder You can view the URL as a PSK between legitimate viewers. It can be considered as a secret among a few persons, and that's why Google warns not to share it with everybody. Sure, Google offers a 2nd method that's safer, but this one is sometimes more convenient. It's the usual trade-off between usability and security. And in practice, it is used as a shared secret (whether you like it or not), so it's good that Google uses a big search space, when it could have used a shorter one like the ones used by URL shorteners.
    – A. Hersean
    Sep 10, 2021 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.