Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make configurable length of shared link token #419

Closed
savely-krasovsky opened this issue Jul 15, 2016 · 9 comments
Closed

Make configurable length of shared link token #419

savely-krasovsky opened this issue Jul 15, 2016 · 9 comments

Comments

@savely-krasovsky
Copy link

savely-krasovsky commented Jul 15, 2016

For example now, I have this:
l33t.host/s/CpjUhnJuFEyMQzn

And we can have this:
l33t.host/s/AvJHo

But It's my personal service for maybe 1000 or 10000 (max!) shared files.
And for this aim even 4-5 characters is enough. Why 15?

In Owncloud we don't have theming, now we have, and it's very cool. So why not?

@MariusBluem
Copy link
Member

But It's my personal service for maybe 1000 or 10000 (max!) shared files.

You are right, but there are some other users, using more than 1000 files and shares 😜 I think shortening the URL makes sense anyway. An option for personalize the URLs would be nice. I think of something like l33t.host/s/pictures-of-party.

If the URL is too long for your use (e.g. Twitter) you could also shrink the URL with a service like goo.gl 😉

@savely-krasovsky
Copy link
Author

savely-krasovsky commented Jul 16, 2016

@Mar1u5 okay, lets use simple math.
We have common formula for combinations:
a73cf8428fc85510cade14325f0d8a3f460ed0c6
Where is n = 52 (count of letter in Latin alphabet: lowercase + uppercase) and k is length of our token.
So now lets calculate:
For 4 symbols:
msp92920i342afidcgh17h00003daec986hdhd4iid =
270 725!
For 5 symbols:
msp2647212ii36c900g1he5000010hic0biac6fhiii =
2 598 960!
For 6 symbols:
msp1741238856ff5de0g2320000160egg0g46fg2dga =
20 358 520!
If you really so scary for some strange users that are using over 20 millions shared links (LOL), just set 6+ symbols by default. But for me even THREE symbols is enough (22 100 combinations!).

Now we have 15 symbols for 4 481 381 406 320 combinations. Almost 5 trillion? Really? Why?

@rullzer
Copy link
Member

rullzer commented Jul 16, 2016

It is not only about the number of possible shares. It is also about security. You don't want people to be able to guess your tokens.

@savely-krasovsky
Copy link
Author

savely-krasovsky commented Jul 16, 2016

@rullzer okay, we can show people some attentions about security and by default set 15.
And I don't understand: If you already create SHARED link WITHOUT password, you shouldn't scary about security... Or should?.. Sorry, It's illogic for me.

PS. Sorry for my bad English...

@rullzer
Copy link
Member

rullzer commented Jul 17, 2016

Well a password is yet another thing to distribute.

With 15 tokens you are fairly safe to somebody even finding a link that works. It is all about reducing the attack vector.

@savely-krasovsky
Copy link
Author

savely-krasovsky commented Jul 17, 2016

@rullzer I understand that it's reducing. But It's not the "critical security point", it's just a little plus to security. I think it should be customizable with some attentions. Why I have to use goo.gl, bit.ly and other such services if I already have short domain name that enough for me?

I use Nextcloud with ShareX for fast creating gifs, screenshots, videos, etc. An indispensable thing (just try!) And I always get those long links! This is the only negative.

@MariusBluem
Copy link
Member

If you already have a short domain name, https://yourls.org could be a workaround ... this is for hosting your own URL shortener. Maybe you could also develop an proper integration as an app 😉

@rullzer
Copy link
Member

rullzer commented Jul 17, 2016

I get that it is one of things that is nice to have. but it is another configuration variable in the matrix. With the potential downside that if people mess up (and people will mess up) exposed data.

I agree with @Mar1u5 that an app that does shortning would be better.

@savely-krasovsky
Copy link
Author

savely-krasovsky commented Jul 17, 2016

@Mar1u5 thanks for idea with yourls.org. Just installed it on my server. With ShareX I automated it:
image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants