iwork.com security floor

[moredrunkmale]

I just made a document in Pages, and uploaded it to iwork.com.

i selected sharing, which means it only those who i want to see the document get specific links, i thought for added security i should add a passwrord

Heres the thing, if you follow the link below:

https://www.iwork.com/r/?d=Untitled.pages&a=p142407883&u=films@charlievb.com&p=AA0F8F5DDC&s=1

you will be going to the page that appears whenever you are invited to see a private document. The password dialogue box will come up, menaing all you need to do to view this secret document is put in the password.....or.......

on this page goto the browser bar and delete some of the end of the url upto &; so it will be like this:

https://www.iwork.com/document/?d=Untitled.pages&a=p142407883&

hit enter.

Voila, you are not in a document that you should never be. The one you are looking at right now is just a test to prove this example.

Im am appalled about his, it wouldn't be difficult for someone to scan someone's emails or somehow get hold of an individuals url. With the way this is setup, i considerd the password accounts for about 80% of the safety of the document. So long as it is complex, it could never be cracked, and with that it wouldnt even matter if someone knew the direct link (provided he cant remove bypass the need for the password by simply removing a few characters form the URL.

Super joke

 

[Shawnpk]

Not really sure what you're getting at here. When I follow your steps, it takes me to a page to login to iWork, but even if I put my own credentials in, it tells me either my username or password is incorrect so I can't get in. Maybe it works because you're already logged into your own account?

EDIT: I believe it may indeed be because your accessing your own account. If I try your steps with my own document, I can view the document, but if I try it with your document, I can't view it.