4 ms·
How is a URL with that's not linked anywhere different from a password?
by matt4077 11y ago
How is a URL with that's not linked anywhere different from a password?
- skybrian 11y agoA secret kept in a URL is less likely to be treated as confidential, both by people and machines. For example, compared to a cookie, they're more likely to be shared or logged.
- jakobegger 11y agoIt is not. The problem is that short URLs are often only six characters long, so they are just as safe as a six character password (ie. not very safe)
- patcheudor 11y agoFar less safe because you use a password in combination with a userID so to crack someone's account you must have their login name and password. Six characters are six characters, easy.
- tedmiston 11y agoOne difference is a GET is likely to have less/no rate limiting vs. a login POST, making it faster to brute force.
- mikegerwitz 11y agoAre you confident that it doesn't appear anywhere else? There's two main concerns: the first being that you use a URL differently---and think of it differently---than a password; and the URL persists in various forms. Accessing a resource on the Web might be logged in numerous places---e.g. your web history and internal network logs or MITM if not over https---and might be sent as metadata, like a referer header to another website. Imagine if all of your passwords were logged by your client any time you entered them in.
- mikegerwitz 11y agoI don't mind downvotes (and this appears to only have been downvoted once), but I do want to express legitimate concern over that: what I said is a standard security concern, and precisely why you don't put sensitive information in GET requests. I hope that others aren't dismissing this issue.