Allow uploading with high-entropy URL keys #59

Closed
opened 2020-05-27 22:37:53 +02:00 by electricdusk · 2 comments
Owner

I often have the situation where I use rushlink without the requirement of having a short URL. Moreover, in some of these cases, I would rather have a URL that is resistant to enumeration attacks.

I propose that we allow a flag "entropy", with a number as argument, or a boolean "high-entropy" value, that will instruct the server to generate a key with a minimum amount of entropy. I would propose a very conservative 96 bits, which is equivalent to keys of 16 characters.

I often have the situation where I use rushlink without the requirement of having a short URL. Moreover, in some of these cases, I would rather have a URL that is resistant to enumeration attacks. I propose that we allow a flag "entropy", with a number as argument, or a boolean "high-entropy" value, that will instruct the server to generate a key with a minimum amount of entropy. I would propose a very conservative 96 bits, which is equivalent to keys of 16 characters.
electricdusk added the
feature
label 2020-05-27 22:37:54 +02:00
electricdusk changed title from Allow requesting of high-entropy URL keys to Allow uploading with high-entropy URL keys 2020-05-27 22:38:05 +02:00
Author
Owner

Update: because of the way keys are encoded, every character adds 5 bits of entropy. If we take a key of 16 characters, we still have 80 bits of entropy, which should be fine.

Update: because of the way keys are encoded, every character adds 5 bits of entropy. If we take a key of 16 characters, we still have 80 bits of entropy, which should be fine.
Author
Owner

Fixed by 6d3e8028cb.

Fixed by 6d3e8028cb.
Sign in to join this conversation.
No Milestone
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: electricdusk/rushlink#59
No description provided.