1

Today I found out that the URL of Instagram private accounts' images and the URL of files I sent to my cousin in Discord are accessable even if I am not logged in or even on my phone using a VPN. For example the following link is an image that my cousin sent me on Discord:

https://media.discordapp.net/attachments/526066590396055583/722234841835241542/Red_Dead_Redemption_2_Screenshot_2020.06.16_-_04.11.40.66.png

or an image that I sent as a message on Instagram:

https://scontent.cdninstagram.com/v/t1.15752-9/344096097_1594161011082106_6724090341083400602_n.jpg?_nc_cat=105&ccb=1-7&_nc_sid=5a057b&_nc_ohc=QwWHPbyYX2gAX_Q1AwL&_nc_ad=z-m&_nc_cid=0&_nc_ht=scontent.cdninstagram.com&oh=03_AdTanu5VjJMzQnTxhoFx_DXhmRmMo-ZxcNJ0sHiTS1yx3w&oe=648219A4

How is this considered secure? What are the odds of a random URL points to nothing instead of a file?

7
  • I find that many platforms are somewhat weak when it comes to direct linking. I guess the reasoning is that you wouldn't have that link if you weren't a logged-in user yourself, and distributing it is no different than giving away your password, which they can't prevent either. "Carbon unit error." On the other hand, vague sharing of access is very common (maybe I don't want everyone on the server to have a permalink, especially if I can't manually delete the file later). It's just security through obscurity. Commented May 9, 2023 at 19:23
  • @LukeSawczak ah, of course - it's been a long day
    – schroeder
    Commented May 9, 2023 at 19:24
  • @LukeSawczak but it is almost impossible to get anything from a random password. But what are the odds of getting a file by a random UUID if the server let you search for a file without any restriction?
    – Dante
    Commented May 9, 2023 at 20:03
  • Ok, these links work, but how were you expecting these to be secured? You have purposely shared them. How is the recipient supposed to access them without them being accessible? These aren't instances of links to images that you have not shared.
    – schroeder
    Commented May 9, 2023 at 20:16
  • 1
    We have quite a few Q&As on that topic: security.stackexchange.com/questions/58215/…
    – schroeder
    Commented May 9, 2023 at 20:32

1 Answer 1

2

If the URL contains a sufficiently long, randomly generated number (like a UUID version 4), then trying to guess it through brute-force is absolutely hopeless, no matter how many files have been uploaded. For example, a UUID v4 contains 122 random bits and therefore has 2^122 possible variations. In decimal representation, that number has 37 digits.

Of course this doesn't help if the URL is accidentally or purposely leaked. Then anybody who knows the URL can access the file until the provider either deletes the file or “disables” the URL. For more serious cases, there are plenty of file sharing services which do implement authentication (e. g. through a password).

Not the answer you're looking for? Browse other questions tagged .