# Is using a GUID for an uploaded filename secure?

**URL:** <https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062>\
**Category:** Development\
**Created:** [7월 29, 2017, 11:53오전 UTC](https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062 "2017-07-29T11:53:48Z")\
**Posts on this page:** 1\
**Showing post:** 14

<div class="post-metadata">

**Author:** ![Vitaly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vitaly/32/120475_2.png) [@Vitaly](https://meta.discourse.org/u/Vitaly)\
**Post date:** [7월 29, 2017, 3:47오후 UTC](https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062/14 "2017-07-29T15:47:08Z")

</div>

> [@codinghorror](#):
>
> This is a nonsensical argument; do a forgot password reset via email on any website and you will get what is, in essence, a clickable unguessable random GUID. If you forward that email with the clickable GUID or it is intercepted by an attacker… you are gonna have a bad time.

I do not agree. Proper OTP token implementation includes client IP check. If you reset password or request auth link, you should click it from the same device (and in limited time). Even if link leaks, it will not be useable, because another person/bot will have invalid IP address.

> [@codinghorror](#):
>
> The only thing that can protect you is two factor auth.

That’s intended to solve another kind of issues, not unexpected data leak mentioned before.

---

_[View the full topic](https://meta.discourse.org/t/is-using-a-guid-for-an-uploaded-filename-secure/67062)._