Contents
Are private URLs safe?
It’s not secure. For HTTP traffic your secret URL would effectively be public as soon as you use it. Without any password protection an eavesdropper listening to your network traffic could see the URL you send and then visit the same page.
Are Google Drive links secure?
When you upload files to Google Drive, they are stored in secure data centers. If your computer, phone, or tablet is lost or broken, you can still access your files from other devices. Your files are private unless you share them.
What does it mean to turn link sharing on?
You can send other people a link to your file so anyone with the link can use it. When you share a link to a file, your name will be visible as the owner of the file. To decide what people can do with your file when you share it, select an option. Learn more about how others view, comment, or edit files.
What are the dangers of a shared link?
Another misconfiguration that could expose shared links is on the application provider side. If the provider misconfigures their robots.txt file, which instructs search engines which paths not to crawl, and one of its internal application pages is inadvertently crawled by Google, you could see private information show up in public search results.
Is the URL to IaaS portal unguessable?
The link itself is most likely unguessable (it includes what looks like an md5 hash and 2 GUIDs), but anyone with access to that URL will have unrestricted access to the IaaS portal for several hours (the link seems to expire after that time). I have tested that access via the link is not restricted to my specific IP address.
How are external links used to share information?
Many web applications give users the ability to share private information with unauthenticated users via obscure, publicly accessible URLs. These URLs, often called “external links” or “shared links,” are a convenient way to collaborate with people without giving them a username and password.
Is it safe to use a private url?
When using a private URL, you should always assume that it can be compromised — you should design such a URL so that even if it is compromised, the resource will not leak information to the attacker. Private/hard to guess URLs are not equivalent to password-based authentication.