Question

To be able to view a case, a brute force attack of only 839,808 requests (on average) is enough. Read this answer and my comment for why.
Even for slow web servers taking 0.1s per request this takes only a day. And in another day (on average) one has access to all other cases of the correspondent.

I think all this is very insecure. I have a feeling that Fog Creek thinks it's secure enough for everyone.

Why?

Answer 1

This has been locked down by both extending new ticket lengths and implementing a rate limiter in order to defeat guessing attacks.

The patches are available in FogBugz 7.3.5, which is now available. Release notes are here: http://www.fogcreek.com/FogBugz/KB/releaseNotes/WhatsNewInFogBugz7.3.5.html.

FogBugz On Demand has been updated as wellwill be updated this weekend (during our maintenance window on Saturday).

This patch will obviously also be included in the upcoming FogBugz 8.0.

We're going to be locking this down a bit in the next 7.0 release and our upcoming 8.0, Michel. Stay tuned to this question for more information.