3

I see from the placeholders I can put in snippets and mail auto-replies that there's something called a "ticket". What is that?

flag

1 Answer

3

The "ticket" for a case is a generated 8-character value, that, when combined with the case number, allows outside users to see certain parts of, and attributes of, their case. It used to be generated only for cases emailed into the system, but is now generated for all cases.

The chance of a random outside user guessing this ticket value is 36 to the power of 8, about 2,821,109,907,456 to 1.

If someone was trying to "brute force" access to a case, you would almost certainly detect the millions of hits on the same case, and we certainly will detect it on our servers (for those folks on FogBugz On Demand).

You can send a customer the ticket url using a snippet.

link|flag
Rich, I noticed/found that the 8 characters consist of a four character part to view the case, and another four to view the Your Cases list below. Is that correct? – Michel de Ruiter Jun 15 2010 at 10:06
The chance is much lower: 36 to the power of 4 or 1,679,616 to 1, to view the case, and another 1,679,616 tries (max) to also view the Your Cases list... – Michel de Ruiter Jun 15 2010 at 10:08
That is correct (I just fixed the math above), but it requires the attacker know that only the first four are needed to get just the one case (which you just told them ;) – adambox Jun 15 2010 at 15:32
See fogbugz.stackexchange.com/questions/1073/… – Michel de Ruiter Aug 17 2010 at 20:17

Your Answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.