Assuming we're assuming SSL, then a string in the URL could be more secure than a password because it could be longer than a human could comfortably remember. L

Assuming we're assuming SSL, then a string in the URL could be more secure than a password because it could be longer than a human could comfortably remember. Longer = harder to brute force, plus you can block (or teergrube, or whatever) any IP's that try to guess a URL and fail. You can add an option to delete/rekey the image too. At that point the URL is exactly as secure as the method you use to send the URL -- just like a password.