3 ms·
I guarantee you that I can craft URLs users will click even if the whole URL is exposed. This "solution" makes developers feel better but provides essentially z
by Godel_unicode 8y ago
I guarantee you that I can craft URLs users will click even if the whole URL is exposed. This "solution" makes developers feel better but provides essentially zero additional security.
- azinman2 8y agoCan you give an example? And will it never help? I think it’s silly to argue against this. It’s like saying “computer security is hard so why bother at all.” It’s a continued arms race, where you continue to make things harder and harder. This strategy is working the rate at which people are hacked on platforms like iOS is a fraction of what it used to be like for general computing. There will always be security holes, but you plug them as you find them just as you create mitigation’s against classes of problems to the best of your ability. Why make it easy for the attacker?
- Godel_unicode 8y agoNever is a silly standard to measure against. I'm clearly not saying don't do it at all, I'm saying that this approach won't succeed at anything other than making developers feel like they're Doing Something™. Actual spam filtering and 2fa are examples of real security, showing users the URL is an example of security theater. The corollary is the nonsensical "security is hard so let's force non-technical users to do it".