4 ms·
> If your security depends on someone not guessing a URL, shortened or not, you're doing something wrong. Why? Done properly, a secure URL should be as long an
by morgante 11y ago
> If your security depends on someone not guessing a URL, shortened or not, you're doing something wrong.
Why? Done properly, a secure URL should be as long and contain as much entropy as a strong password.
Are all systems which depend on someone not guessing your strong password wrong? Are practically all encryption schemes wrong?
- danielweber 11y agoURLs leak in a bunch of ways. Cached in browsers and proxies, sent in referers, sent in toolbar requests, logged in access.log files. I'm not saying that it's necessarily wrong to use a long URL as security; sometimes the problem constraint means that is the only way to do it. I've done it on rare occasion. But I also made sure that management knew there was a risk here.
- rkangel 11y agoIf that URL is being sent over an HTTPS link (which of course it should be) then the only two points that can log/cache it are the browser at the local end, and the server at the remote end. The latter is up to server design, the former is an interesting point. Browsers are unlikely to cache get parameters, but these things might end up in history etc..
- jessaustin 11y agoThe "Referer" header can also leak URLs.
- jessegreathouse 11y agoBecause access to that resource can be replicated by simply viewing network traffic logs. Sending authorization info in the headers over SSL would be much more safe.
- morgante 11y agoFirst of all, any secure resource should only be accesses over SSL so I assume that. The path is exactly as secure as authorization headers. Network logs will not show the path of SSL requests (it's encrypted).
- zaroth 11y agoURL based Bitcoin wallets proved this not to be the case. URLs get picked up by Omnibar, Skype, etc. they find their way into search results... I wouldn't even trust secret material in the fragment-id even though that in theory is safer.
- ikeboy 11y agoDoesn't excluding them in robots.txt solve the search engine problem?
- _Understated_ 11y agoFollowing the rules laid out in a robots.txt file is optional. The reputable search engines tend to play by the rules but dodgy ones? Not so sure.
- ikeboy 11y agoThe dodgy ones don't have access to the URLs. The example was Skype links: if Microsoft scrapes those, they'll follow the rules and not make them available in searches. If you give your link to a dodgy search engine, you've lost.
- deleted 11y ago[deleted]
- FLUX-YOU 11y agoHe's saying it shouldn't be the only layer of security.
- barrkel 11y agoHow many layers of security should there be when you give someone driving directions to the abortion clinic?
- IanCal 11y ago> Are all systems which depend on someone not guessing your strong password wrong? Are practically all encryption schemes wrong? No, but if your security system has a password and only one account shared by everyone where the password is shared as plain text (typically just emailed from person to person) without any sort of user access logging then it's got major problems. With just a URL you have no idea who has access and the only way of revoking access to anyone is to permanently move the resource and then get back in contact with everyone who should have access by sending the new "password" around. > Are practically all encryption schemes wrong? An encryption scheme that involves the users sharing the only password through far less secure channels?