TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: Companies giving access to personal data on public URLs

4 点作者 krackout超过 2 年前
Industry standards - Companies giving access to sensitive personal data (contracts, photos) on publicly accessible URLs.<p>I&#x27;ve recently come across the same issue twice, with major companies, so probably it has become a mainstream policy:<p>The first one, a multinational telco. I agreed to a new contract, which was published on a public URL for me to check and sign. The contract (which included my social security number, ID number, full name, date of birth, etc) was there for about a month; it was removed after I protested. I can&#x27;t tell for how long it would be there.<p>The second one, an international enterprise: After I asked for my data stored on their systems (they give you the option, no special request) they send me a public URL also. It included my ID photos. They were there for 3 months, according to their policy. As an international company, they were much more cumbersome (rather unwilling) to remove them before the time their policy dictates; to be honest, I doubt if I spoke to any human being, probably they were all bots. I can&#x27;t tell if my ID photos where publicly available after I asked my data or from the day I signed in.<p>Both companies answer was on the same basis: It&#x27;s a URL which is not searchable (no results for these kind of URLs from internet search engines) so since I&#x27;m the only one who has it, I&#x27;m the only one capable of accessing it. I consider this to NOT be secure. Like having something valuable on a public road, but it&#x27;s a small road that no-one passes by; most probably, but not 100%, it won&#x27;t be stolen.<p>So my questions for anybody in the IT security or audit industry,<p>- how is it possible for this policy to be acceptable from major companies?<p>- Can it really be considered safe, a public URL; just because it&#x27;s long, no results returned from search engines, and send only to one person? Send by non-encrypted e-mail, so even if the rest of the chain would be secure, it could be breached through mail.<p>- If a malicious person (cracker, black hat hacker, whatever the terminology) or just a curious and very lucky person who tries many different URLs, access these data: Is there any way to persecute him&#x2F;her? He did nothing unlawful, He just opened a public URL.<p>My question to hackers, have you managed to access such personal data on enterprises URLs? Is it really tough to traverse their sites to locate them?

1 comment

raxxorraxor超过 2 年前
Did the URL contain a capability string? This is a key that only you posses ideally and the URL is only active for a limited time. This is how every [edit: most] password reset links work.<p>Yes, the URL is on the public net, but unknown for everyone aside from you.<p>&gt; Can it really be considered safe, a public URL; just because it&#x27;s long<p>Yes: <a href="https:&#x2F;&#x2F;www.w3.org&#x2F;TR&#x2F;capability-urls&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.w3.org&#x2F;TR&#x2F;capability-urls&#x2F;</a><p>Depends on the implementation of course. Many use the format of a UUID like this: 07463cd8-3f1f-11ed-b878-0242ac120002, although you should NOT! use a UUID, only the format or better something else.<p>But it is considered safe provided the link is only valid for a limited time (3 months should still be ok).<p>This mechanism should regularly be reevaluated though. It is especially security mechanisms that can compromise it. Corporate mail &amp; firewall security will see the link, might log it somewhere where it can be exposed, etc.<p>But the fundamental mechanism is considered to be secure.<p>edit: The requirements for it to be secure are that mail and http access is secured by TLS of course.
评论 #33006777 未加载
评论 #33008989 未加载