Somebody needed a contract
looked at by a lawyer
outside the company.
The lawyer had no account.
So the file got a link,
long, random, impossible to guess,
and the setting said
anyone with the link can view.
It was a sensible choice.
The link could not be guessed.
It did not need to be.
Watch where it went.
Into an email,
which was forwarded
to a colleague of the lawyer,
and then to a client
who did not need
the pricing schedule on page nine.
Into a chat,
where the preview service
fetched it
to draw a tidy card,
from a server you have never heard of.
Into a ticket,
pasted as context,
in a tracker
that forty contractors can search.
Into a browser history
on a shared machine
in a hotel business centre.
And back out again,
eighteen months later,
still working,
because nothing ever told it
to stop.
An unguessable link
is a password
that gets pasted in public
as a matter of routine.
It is a key
with no name attached,
no expiry,
and no record of who turned it.
The door was built properly.
Its key simply travels
through every channel
you use to send links,
which is all of them.
So treat the link as what it is.
A credential.
Give it an expiry by default,
and make forever
something a person has to choose
and has to justify.
Scope it to a single file,
not the folder
that will fill up next month.
Make it revocable
without deleting the document.
Record every open,
so that when somebody asks
who has seen this,
you have an answer
that is not a shrug.
And for anything
you would not read aloud
in a crowded lift,
ask for a sign-in,
even a one-time code by email,
so the link finds a person
instead of anybody.
Then go and look
at what your own account
has shared this way.
Sort it by age.
The oldest link on that list
is still valid,
and you do not know
where it has been.
– Serguey Asael Shinder
Top comments (0)