The road to hell is paved with good intentions, they say.
So, it was a good intention when someone (not me) decided to install a link shortener and send password reset links through it, before producing the printed newsletters that would be sent out to individual members. They would need to type the URLs in by hand, so a shorter URL was a good idea. At least, it must have seemed like it, at the time.
Today I took a look at this system, which I was asked to clean up before it gets used again after several months of being ignored. I admit it didn't click in my mind immediately, but after producing some newsletter content in our staging system and verifying the shortlinks were being recorded properly, it suddenly jumped out of the screen and bit me on the nose:
The shortener was producing sequential links for a bunch of password reset links.
What this meant in practical terms is that two newsletters sent out with password reset links for two different users would send them URLs like http://foo.com/z1 and http://foo.com/z2 and while these were very short for the user to type in they were not easy to type in, if you require "correctly" as part of the measurement of how easy it is. They are so short and the space so condensed that mistyping won't get you a 404, but someone else's entirely valid password reset link. This is terrible. There is a reason password resets give you links with long randomized sequences of characters, and all of those reasons were being thrown out the window.
Turns out, a shortened URL can be too short.
Comments
((((26 + 26 + 10)^6) / 5 000) / 3 600) / 24 = 131.482027
131 days to go through all combinations. So if you have maybe 50 users at a given time resetting passwords, you'll be finding links every 2.6 days on average.
While not addressing the predictability problem, it would address the "oops" problem.