# Is using a GUID for an uploaded filename secure?

**URL:** <https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062>\
**Category:** Development\
**Created:** [July 29, 2017, 11:53am UTC](https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062 "2017-07-29T11:53:48Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\
**Post date:** [July 29, 2017, 3:00pm UTC](https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062/13 "2017-07-29T15:00:25Z")

</div>

This is a nonsensical argument; do a forgot password reset via email on any website and you will get what is, in essence, a clickable unguessable random GUID. If you forward that email with the clickable GUID or it is intercepted by an attacker… you are gonna have a bad time.

The only thing that can protect you is two factor auth.

---

_[View the full topic](https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062)._