5 ms·
The possible advantage of the encoding is that it that it can be encrypted and make parameter hacking impossible.
by BurningFrog 4y ago
The possible advantage of the encoding is that it that it can be encrypted and make parameter hacking impossible.
- PetahNZ 4y agoYou don't need to encode it to do that though. You can just sign the URL
- A4ET8a8uTh0 4y agoHarder. Not impossible. Harder. I don't want to make it sound like I am being disagreeable just for the sake of being disagreeable. If there is one thing the past decade has shown, it is that hacking is just a matter of time and whether a determined person is willing to direct resources at it.
- rsync 4y agoI see you, and raise you: What if they encrypted the parameters with a one-time pad ?
- A4ET8a8uTh0 4y agoHmm. Most likely ( if not only ) way to counter that would be social hacking ( because I assume the pad is generated automatically from some source ), which seems like the best way to obtain it. Then again.. I am not an expert in this field ( but we do sometimes use parameters from link for some projects ). Is it refreshed after some time passes ( if so, maybe there is an easier way to just observe what changes )?
- naasking 4y agoOne-time pads have to be stored server-side. If you're going to do that, you might as well just store the data itself under a GUID server-side so you avoid network transfers and then put the GUID in the URL.
- hot_gril 4y agoWould have to do the signing server-side, predicated on the server checking the entire state to ensure validity. Such effort being put into preventing parameter-hacking would suggest there are serious vulnerabilities in that website. The URL is meant to be modified by the client.
- hot_gril 4y ago> The URL is meant to be modified by the client. Clarification, the human user probably won't want to modify the URL, but the client will.
- thomasahle 4y agoWith something nice like the Google url, I would happily modify it myself.
- rattlesnakedave 4y agoYeah, why not just base64 encode, shove that into a db with a shorter key? I'm pretty positive this is how tiktok works for sharing videos.
- StevenNunez 4y agoProbably don't want to pay for space for unauthed users.
- deleted 4y ago[deleted]