Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a link to a file which is stored in cloud:
(I have edited a character from the original for privacy)
So if the garbage string at the end is altered, what is the chance that a file stored in someone else's cloud gets accessed?
Is this possible?
The chance is N in 153,803,885,110,405,674,678,434,597,293,100,547,399,764,930,461,696 where N is the number of files stored under /file/d with public view permissions set (TY @Mike Ounsworth).
So, there's a chance, but it's not a great one.
The "garbage string" is a 28-digit name which appears to consist of uppercase letters (26), lowercase letters (26), and numbers (10). So each digit can be one of 62 characters. The number of possible combinations for that string are therefore 62^28.
It depends on how many files there are and how the links are assigned. A security conscious developer will make the ID random for each file. The difficulty of guessing someone else's random ID is based on the length of the ID and the number of characters that make up the alphabet.
The link you posted has 28 characters, but you said you deleted one, so we'll call it 29 characters. We can see characters from upper and lowercase ASCII and numbers. So lets also assume the alphabet consists only of those groups. This leaves us with an alphabet size of 62 characters. To calculate the size of the keyspace we use
keyspace = (alphabet size)**(length of ID)
thus
keyspace = (62)**(29) = 9.5358409e+51
Thats an insanely large number. So essentially you'd have to do 9.5e+51 guesses in order to find a particular file. Note that the above assumes an ID that is always 29 characters. If the ID is variable length (for example, between 29 and 50 characters), the numbers explode even more.
The question becomes "If I pick a random ID what is the likely hood that I will return a file".
This question can only be answered if you know how many valid IDs there are. For the sake of simplicity, lets assume every person on the planet (7.1e+10) has uploaded a thousand files. This would mean there are 7.1e+12 valid IDs. Even if we assumed this number (and I think we can all agree that the number is much lower in reality), the likely hood of guessing a correct number would be
Likely hood of correct guess = (number of valid IDs)/(keyspace)
= 7.1e+12 / 9.5e+51
= 0.00000000000000000000000000000000000000074
So in order to be sufficiently protected the developer should ensure:
Yes and no. That string is associated with the ID of the document, which lets Google know what data to retrieve. So if you change that string there's a possibility you'll find one that matches a different document. There are a lot of possible character combinations so the chances of randomly finding one is probably pretty low, but not impossible.
However, Google does enforce access control checks on these documents before delivering them, which by default are restricted to the account that created them. A user can change the permissions to make a document public, in which case it is possible you could find a readable document by randomly guessing IDs. It would be even less likely that you guess a valid file ID and that file happens to be public.
The "garbage string" you speak of is actually the identifier or unique name for your file. It's possible that if you change one character, that would be the identifier for another file. It's unlikely because there are so many possible identifiers.
Finally, it's just a URL. Just because you have the URL doesn't mean that Google Drive will actually deliver the file to you.
