Still, these URLs shouldn't be leaking out to search engines, and from there, to anyone with a related Google AdWords campaign.ĭropbox does let users restrict access to Share Links, but this feature is only available in the paid "Business" version of the service, not the free version that most people use for their personal documents.īox allows users to restrict access to shared links on the personal and the business versions of its service, but this feature is not enabled by default. Users know that anyone with the URL to that document can view it. This doesn't mean all Dropbox and Box documents are susceptible - just ones that have been set to be shareable via URL. However, Cluley points out that Dropbox's solution does not address the issue of people entering shared links into search engines, which is how the private links in Intralinks' Google AdWords campaign reached them in the first place.
Security expert Graham Cluley suggests another possibility for how search engines are scooping up these supposedly private URLs: If a Dropbox or Box document contains a link to a third-party site, which a user clicks on from within Dropbox or Box, the referring URL sent to that third-party site will include the URL of the supposedly private Dropbox or Box document.ĭropbox has addressed this latter vulnerability, the company announced in a blog post last night (May 5). Tech-savvy readers might think this a silly mistake to make, but on some browsers, a built-in search engine field is located right next to the URL field, and it'd be easy to copy-paste a URL into one rather than the other. How is this happening? Intralinks suggests that search engines might be acquiring these links because some people copy and paste the URLs of shared Dropbox or Box files into a search engine instead of the browser's URL field. That's how Intralinks, via a simple and totally legal analysis of Dropbox and Box's Web traffic, was able to see these URLs along with the rest of the data that Google AdWords had gathered.
Shared URLs should not be indexed by a search engine, yet somehow Google Analytics and Google AdWords are getting hold of these links.
0 kommentar(er)
