Shoutkey is unsafe
A toy investigation into Shoutkey’s safety led unsurprisingly to multiple private documents.
Here’s the Gist.
URL shorteners generally enable unsafe practices, but Shoutkey reigns supreme by using short, common words as shortener keys, foregoing request rate limiting, reusing keys, and providing no safety warnings. And while Shoutkey is just someone’s project, it’s gaining popularity.
Using a list of common English words, we can generate a list of plausible Shoutkey URLs and check whether Shoutkey redirects us to a user’s URL. The 9000 words tested led to around 80 user URLs and a hit rate of almost 1%. Multiple user URLs led to writable documents.
Shoutkey makes URL scanning too easy. Casual users won’t realize
- the consequences of Shoutkey exposing their data to the world
- anyone can peruse their data, and even overwrite or remove editable documents
- Shoutkey is a single-person project, meaning things like request rate limiting aren’t present and won’t be implemented
The main benefit of Shoutkey over other shorteners is its use of real-word keys. To preserve this benefit while increasing the key search space, switch to using Diceware-like keys.
At the very least, a proper landing page warning message is in order.