How unlikely is it that a Google Doc link is guessed?

Question

Most (if not all) of us know that a Google Doc link looks something like this: https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit

There are becoming several tools (like Trello) that allow you to "attach" a document from your Google Drive. When you attach a document, you have to manually go in and add people to the document - or say that anyone with a link can edit, view, or comment.

From a security standpoint, how risky is just saying that everyone can edit? What is the likelihood that someone could brute force guess your Google Doc link, and thus gain access to your document?

My guess here is that there are a lot easier avenues (e.g. guessing someone's Trello PW, rubber hose decryption) to gain access to whatever information the attacker was looking for, mainly on the obvious fact that there are a lot of characters there, plus the assumption that Google probably keeps an eye out for that sort of sneaky behavior...

But let's say that you were able to brute force the links - what are the vulnerabilities with this approach?

Answer 1

Assuming the document ID distribution is uniform and unpredictable, here's the math:

• 44 characters long
• Uppercase, lowercase, digits and underscore =
  26 + 26 + 10 + 1 = 63 character alphabet

Therefore:
Total possible combinations: 63⁴⁴
keyspace: 263 bits ⇐ 44 * log₂(63)

And we know that brute-forcing a 263-bit key in any reasonable amount of time (lifetime of the universe) is well beyond what the laws of physics will allow, no matter how advanced and magical and "quantum" the computers may become.

This may seem a bit bold an assertion, but it comes from the fact that the sun simply doesn't put out enough energy in such a timeframe to count that high. See page 157 of Schneier's Applied Cryptography for the details, or look at this answer here where I summarized the math, or this answer where lynks quoted the entire section from Schneier's book.

Specifically, the sun's energy is only sufficient to count to 2¹⁸⁷ per year, meaning it will take 2⁷⁶ years with our own sun, 2⁷⁵ years if we could harness 2 suns, etc. You might barely have enough power to count to 2²⁵⁶ if you were to power your computer with the supernova destruction of every star in the Milky Way Galaxy. So that's getting somewhere.

Answer 2

While it still may take a very large time to bruteforce (close to infinity), it is not really smart to keep confidential documents protected that way. If you don't care who reads it then it doesn't matter. But I wouldn't put the specifications of your latest project on Google Docs.

You are also risking the fact that the links may leak, when authentication is needed you can still prevent people from accessing your file. If, however, authentication is not forced, anyone that can get its hands on the link, can view the document.

Answer 3

I'd be more likely to try and make sure all my users had google logins and had permissions on the document folder - there's shades of grey between "wide open" and "add each permission individually".

Apocryphally I have seen "patterns" in docs links - so I remain unconvinced about the level of security provided, though I would not like to try and break in myself!

Also, be aware of "link lying around" attacks - someone mentioned browsers remembering it, there's also caches, web proxy logs, url shorteners, search engines, email forwarding... al sorts of dubious ways the link could spread, likely to people who may find it "useful".

Worse, using the "all open" method, you don't know if someone's poking about, and if they do, applying more security after the fact will suck doublehard.

Answer 4

I put it through a password complexity tester at http://howsecureismypassword.net/ and the result was "It would take a desktop PC about 802 vigintillion years to crack your password". (That seems to be a pretty long time).

That, of course, assumes a random password, which isn't likely the case here. There is almost certainly an algorithm creating these document ID's and if the algorithm can be guessed, that certainly ups the odds that someone can guess the ID's.

Also, no "password strength" tool is perfect. That time is a guess by one system that likely makes assumptions that may or may not be valid. The point of posting it was just as a baseline "Not knowing anything else, how hard would it be to brute-force this?"

But in and of itself, guessing the ID of a particular ID associated with a particular account would be exceedingly difficult. An attacker would need to be logged in as someone that has access to a specific document, which lowers the risk considerably.

Assuming the permissions portion of Google Docs is solid: Only people that you have granted permissions to view the document actually can access it. From that, it is likely that a logged in user could only brute-force documents that they already have permissions to already.

The complexity of the ID isn't the only security tool, it's a layer of obscurity on top of the already-existing security. It may be security by obscurity in one sense, but it's not the sole factor. Security by obscurity is bad only when it's the only measure of defense. If it adds complexity onto the task there is no harm in it, and it can certainly slow an attacker down. It's just not safe to rely on it as your only defense.

Answer 5

Let me add something here as far as the "security level" is concerned. Because the reality of the question comes down to how "safe" am I or "is this secure". The answer is not very safe at all.

What we have to examine is what is the likely hood of this getting compromised. Now explaining this has already been attempted but bare with me. I'm going to try and give a different view.

Is the link encrypted.. kind of but not really. This is security through obscurity not encryption. So the hope is your link is never found out or guessed and that's it... nothing here is encrypted... nothing. Encryption is the act of converting data into something else/other than what it was originally whether scrambling or completely changing/substituting the information. It is definitely hard to just guess this URL no doubt about that, no doubt at all, but this URL is still just a URL and once hit it will return and provides access to your information.

Yeah but no one is every going to guess this in a million billion years... well you hope! The fact is you may never know if or when it does either. Brute force is suffisticated and hashes can be guessed very well it's not like they are going to guess Aaaaaaaaaaaaaaaaaaaa1, Aaaaaaaaaaaaaaaaaaaa2, etc. so many many bad options will be eliminated. they are going to determine what hash is being done and do mathematical legitimate values. They are then able to build a table of all possible values and federate that out to large botnets or tools like AWS lambda etc. where they can try millions of request quickly and it's legitimate traffic to google worldwide.

On top of that your traffic isn't safe much of where you go and what you do bleeds all over the place and others will to. So web analytics/plugins/malware/coffee shops/etc can contain bad code or contain attacks that take your URL and expose it to malicious groups.

The biggest issue being you never know who sees and accesses your files and if you have things in there you do not wish anyone to have access then remove the share link immediately.

I hope this sheds some light on shared links this problem exists for Dropbox or any other share link where credentials are not provided and files are not encrypted or protected at rest.