Hacker News Reader

> It's only secret until someone guesses the link - something they can do without the URL even going through Messenger.

Not really - a sufficiently large random number is effectively unguessable in your lifetime. This is no different than sharing a password with your partner in a private Facebook chat and discovering that outsiders can stumble on it.

View on HN

Your one particular file is effectively unguessable, but that does not mean that guessing at files is a fruitless endeavor.

No, actually. It really doesn't take that many bits of entropy for you to be unable to find any documents in a haystack of entries. My file ID is 45 characters of base-64 encoded string. This is a total entropy of 225 bytes. If there are a quintillion files in google drive (a hundred million files per person who has ever lived), you were loading a million possible files per second, you'd still take several times the expected time to the heat death of the universe to randomly stumble upon one.

I would say it's quite different to sharing a password as text in Facebook chat - the URL is certainly in your browser history as well as any other place that has logged your GET request.

Since it's an HTTPS request the GET request won't have the secret bits available for anyone else to see.

Reply on news.ycombinator.com