Hacker News Reader

Comment by thomasfoster96 | Hacker News Reader

This probably isn't a popular opinion, but I fail to see how this is a problem with Facebook.

The Google Docs URL is public whether or not you send it through Facebook. It's only secret until someone guesses the link (Edit: maybe not mathematically in the case of Google Docs, but many other services use 'unlisted' URLs without having a long token to guess) - something they can do without the URL even going through Messenger.

If you're sharing passwords or confidential information via a public URL with no authentication and hoping nobody finds the address, you're asking for trouble. I don't blame Facebook for not doing anything about it.

View on HN

> It's only secret until someone guesses the link - something they can do without the URL even going through Messenger.

Not really - a sufficiently large random number is effectively unguessable in your lifetime. This is no different than sharing a password with your partner in a private Facebook chat and discovering that outsiders can stumble on it.

I would say it's quite different to sharing a password as text in Facebook chat - the URL is certainly in your browser history as well as any other place that has logged your GET request.

Since it's an HTTPS request the GET request won't have the secret bits available for anyone else to see.

Your one particular file is effectively unguessable, but that does not mean that guessing at files is a fruitless endeavor.

No, actually. It really doesn't take that many bits of entropy for you to be unable to find any documents in a haystack of entries. My file ID is 45 characters of base-64 encoded string. This is a total entropy of 225 bytes. If there are a quintillion files in google drive (a hundred million files per person who has ever lived), you were loading a million possible files per second, you'd still take several times the expected time to the heat death of the universe to randomly stumble upon one.

It's pretty much mathematically impossible to "guess a link" for a google docs or dropbox URL.

Google Docs maybe - but not every service that uses a similar mechanism.

Such as?

YouTube's unlisted videos to name one.

A URL with a long random token is unguessable, same as your login token/session token is unguessable.

Reply on news.ycombinator.com