# The link knows all.

Page: https://stenobird.com/podcast/research-saturday-1377435/the-link-knows-all
Text version: https://stenobird.com/podcast/research-saturday-1377435/the-link-knows-all.md
Podcast: [Research Saturday](https://stenobird.com/podcast/research-saturday-1377435)
Published: 2026-01-31T06:00:00+00:00
Episode link: https://thecyberwire.com/podcasts/research-saturday/410/notes
Audio file: https://pdst.fm/e/pdrl.fm/6ec23a/traffic.megaphone.fm/CYBW1950630347.mp3?updated=1769790876
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/research-saturday-1377435/episodes/the-link-knows-all
Duration seconds: 1301

## Resource

Muhammad Danish, University of New Mexico lead author and cybersecurity researcher, discussing his team's work on "Private Links, Public Leaks: Consequences of Frictionless User Experience on the Security and Privacy Posture of SMS-Delivered URLs". This paper examines how the push for frictionless user experiences has led many services to rely on SMS-delivered, single-click URLs—an inherently insecure channel that can be intercepted or leaked. Analyzing more than 322,000 unique URLs from 33 million messages, the researchers found widespread security failures, including exposed PII across 701 endpoints at 177 services due to weak, token-based authentication that treats possession of a link as sufficient authorization. The study also identified low-entropy tokens enabling mass URL enumeration and data overfetching issues, though disclosures prompted 18 services to fix flaws, improving privacy protections for at least 120 million users. The research can be found here: ⁠Private Links, Public Leaks: Consequences of Frictionless User Experience on the Security and Privacy Posture of SMS-Delivered URLs Learn more about your ad choices. Visit megaphone.fm/adchoices

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/research-saturday-1377435/episodes/the-link-knows-all/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/research-saturday-1377435/the-link-knows-all.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.