> But a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others.

To be clear, did the users intended for these conversations to be shared with someone? Meta just created a guessable capability URL?

Or were all Muse users' conversations by default public, just behind an obscure URL?

▲

cloudbonsai 3 hours ago | parent | next [-]

It seems that Meta assigns a unique hostname to each shared conversation. For example:

> fiscal-review-b4a5ff.cf.metaaiusercontent.com

So when someone opens the link, the DNS resolution exposes the unique hostname. The original bug reporter found dozens of these URLs in passive DNS logs.

	▲	venzaspa an hour ago \| parent [-]
		That is remarkably amateur. I'm not a software engineer by trade nor have worked at a billion dollar company, but knew that to be a bad design within seconds.

▲

skohan an hour ago | parent | prev | next [-]

I remember back when Facebook was still .edu email addresses only (2004 or 2005 maybe), and my university got access, we discovered you could just grab the user id of another user from their public profile, and paste it in place of your own user id on your own profile, and get access to their profile as if it was your own.

▲

fxwin 3 hours ago | parent | prev [-]

Sounds like it's the former: URLs are guessable/easily enumerable but their contents protected by auth unless they're "published" using the share feature