I wonder if this was made by AI or a shit programmer
-
As long as you're not rate limited, you absolutely could.
A UUID v4 has 122 bits of randomness. Do you know how long that would take to brute-force, especially with network limitations?
-
Yes, it can be useful in leading you to look in the right place for more information, or orienting you with the basics when you're working with a technology that's new to you. But I think it wastes my time as often as not.
That's implying that the quality of information from other sources is always better, but I'm saying that's sometimes not true; when you're trying to figure out the syntax for something, documentation and search engines have failed you, and the traditional next step would be to start contacting people or trying to find the answer in unfamiliar source code, sometimes a LLM can somehow just tell you the answer at that point and save the trouble. Of course you have to test that answer because more often than not it will just make up a fake one but that just takes a few seconds.
There are some situations I'm going back to search engines as a first option though, like error messages, LLMs seem to like to get tunnel vision on the literal topic of the error, while search results will show you an unintuitive solution to the same problem if it's a very common one.
-
As long as you're not rate limited, you absolutely could.
You cannot!
-
Sounds like a good case for brute forcing the filenames. Just do the proper thing and don't leave your cloud storage publicly accessible.
Can't be done.
-
This post did not contain any content.
I absolutely despise Firebase Firestore (the database technology that was "hacked"). It's like a clarion call for amateur developers, especially low rate/skill contractors who clearly picked it not as part of a considered tech stack, but merely as the simplest and most lax hammer out there. Clearly even DynamoDB with an API gateway is too scary for some professionals. It almost always interfaces directly with clients/the internet without sufficient security rules preventing access to private information (or entire database deletion), and no real forethought as to ongoing maintenance and technical debt.
A Firestore database facing the client directly on any serious project is a code smell in my opinion.
-
Security through obscurity never works.
It's not security through obscurity in this case. The filenames can't be obtained or guessed through brute force. At least not with current technology or processing power...
Security through obscurity is when you hide implementation details.
Saying that my suggestion is security through obscurity is the same as telling that ASLR is security through obscurity...
-
A UUID v4 has 122 bits of randomness. Do you know how long that would take to brute-force, especially with network limitations?
It taking a long time doesn't make it an impossibility. The fact that it has a limit of 122 bits, in and of itself, makes the possibility of a bruteforce a mathematical guarantee.
-
You cannot!
I cannot. But the bruteforce is a mathematical guarantee.
-
It taking a long time doesn't make it an impossibility. The fact that it has a limit of 122 bits, in and of itself, makes the possibility of a bruteforce a mathematical guarantee.
For all practical purposes, it's impossible.
-
For all practical purposes, it's impossible.
It's not, though. And thinking that it is impossible is why DES, for example, was "translatable" by the NSA for decades. Never assume something is impossible just because it's difficult.
-
Robert'); DROP TABLE Students; --
aw bobby
-
As much as I dislike JavaScript, it isn't responsible for this. The person (or AI) and their stupidity is.
but it didn't help; it was basically the gasoline
-
It taking a long time doesn't make it an impossibility. The fact that it has a limit of 122 bits, in and of itself, makes the possibility of a bruteforce a mathematical guarantee.
By this logic, all crypto is bruteforcable, on a long enough timeline.
A 122 bit random number is 5316911983139663491615228241121378303 possible values. Even if it were possible to check 1 trillion records per second, it would take 168598173000000000 years to check all the UUIDs and get the info on all the users. Even if every human on earth signed up for the app (~8 billion people), and you wanted to just find any one valid UUID, the odds of a generating a UUID and that being valid in their DB is basically 0. You can do the math your self following the Birthday Paradox to determine how many times you would need to guess UUIDs before the probability that any one UUID is valid against a population of the whole world is greater than 50%.
-
By this logic, all crypto is bruteforcable, on a long enough timeline.
A 122 bit random number is 5316911983139663491615228241121378303 possible values. Even if it were possible to check 1 trillion records per second, it would take 168598173000000000 years to check all the UUIDs and get the info on all the users. Even if every human on earth signed up for the app (~8 billion people), and you wanted to just find any one valid UUID, the odds of a generating a UUID and that being valid in their DB is basically 0. You can do the math your self following the Birthday Paradox to determine how many times you would need to guess UUIDs before the probability that any one UUID is valid against a population of the whole world is greater than 50%.
You should read into the NSA's Translator. Granted, it's relatively outdated with shifting text algorithms, but for a very long time (about half a century), it was able to bruteforce any key, regardless of length, in under an hour.
-
You know that's not the Tea code, but the downloader, right?
They're also not using requests very efficiently, so who knows.
-
It's not, though. And thinking that it is impossible is why DES, for example, was "translatable" by the NSA for decades. Never assume something is impossible just because it's difficult.
UUIDs are essentially random numbers, crypto schemes are not, they're not comparable.
-
UUIDs are essentially random numbers, crypto schemes are not, they're not comparable.
The scope isn't if they're crackable (which, if course, they're not, since they're not encrypting anything). The scope is if using UUIDs as filenames in this publicaly accessible db a good way to hide the files. And the answer is: no it is not, because a computer powerful enough can guess all possibilities in a matter of minutes, and query them all against the db to discover all files stored within.
-
You should read into the NSA's Translator. Granted, it's relatively outdated with shifting text algorithms, but for a very long time (about half a century), it was able to bruteforce any key, regardless of length, in under an hour.
I'm not familiar with NSAโs Translator, so any info would be appreciated.
I saw your other comment about DES, and it should be noted that DES was with a key length of 56 bits, and that was enforced precisely because the NSA could brute force it. It wasn't even a secret they could brute force 56 bit encryption, and written into law. Back then, if you wanted to use more than 56 bit encryption in the United States, you had to provide a key escrow system to allow the government to decrypt the content if they needed to. Around the 2000s with the rise of e-commerce, they dropped the export restriction because it was doing more harm than good. No one wanted to use so few bits in the encryption keys, but it was illegal at the time to write software which did.
A UUID's 122 bits of randomness are exponentially more than the 56 bits DES offered. My original point being, all crypto is inherently brute forceable on an infinite timescale, but key length and implementation decisions are chosen to so that it would be computationally infeasible to brute force.
-
I'm not familiar with NSAโs Translator, so any info would be appreciated.
I saw your other comment about DES, and it should be noted that DES was with a key length of 56 bits, and that was enforced precisely because the NSA could brute force it. It wasn't even a secret they could brute force 56 bit encryption, and written into law. Back then, if you wanted to use more than 56 bit encryption in the United States, you had to provide a key escrow system to allow the government to decrypt the content if they needed to. Around the 2000s with the rise of e-commerce, they dropped the export restriction because it was doing more harm than good. No one wanted to use so few bits in the encryption keys, but it was illegal at the time to write software which did.
A UUID's 122 bits of randomness are exponentially more than the 56 bits DES offered. My original point being, all crypto is inherently brute forceable on an infinite timescale, but key length and implementation decisions are chosen to so that it would be computationally infeasible to brute force.
The Translator was the nickname given to, what essentially was, the NSA supercomputer that could solve any (non-shift text) encryption by bruteforcing the key in under an hour (most of the time, in about 15 minutes). I mentioned DES, because it was an encryption so old that nearly everyone has heard about it, and one that I know was used on The Translator. And you're right, DES was capped at 56 bit keys, because they could crack it without The Translator, if needed.
But the scope isnโt if the UUIDs are crackable (which, of course, theyโre not, since theyโre not encrypting anything). The scope is if using UUIDs as filenames in this publically accessible db a good way to hide the files. And the answer is: no it is not a good way, because a computer powerful enough can guess all possibilities in a matter of minutes, and query them all against the db to discover all files stored within.
-
The scope isn't if they're crackable (which, if course, they're not, since they're not encrypting anything). The scope is if using UUIDs as filenames in this publicaly accessible db a good way to hide the files. And the answer is: no it is not, because a computer powerful enough can guess all possibilities in a matter of minutes, and query them all against the db to discover all files stored within.
The powerful enough computer doesn't exist, and will not exist for some time. And even if it exists, it can't query the web server fast enough to have meaningful effectiveness.
So, for all intents and purposes, it's impossible. Period.
