Timeline for Is a long, random string in a URL considered adequate protection from unauthorised access? [duplicate]
Current License: CC BY-SA 3.0
12 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Mar 16, 2015 at 5:15 | history | closed |
Mark Xander Jens Erat Gilles 'SO- stop being evil' schroeder♦ |
Duplicate of Does SSL/TLS (https) hide the urls being accessed [duplicate], Are random URLs a safe way to protect profile photos? | |
Mar 15, 2015 at 14:24 | comment | added | Greg | If there are no other controls and the user is aware of precautions as stated in other comments it is adequate assuming an attacker would need to guess the uuid, if it is truely random and not deterministic, to access the document. It is also dependant on the logging she auditing that takes place, how long the document remains accessible, if the documents are indexed by search engines and effort required to gain access to this information. | |
Mar 15, 2015 at 14:18 | comment | added | Cybergibbons | The site where the links are presented is another site entirely. There is no authentication or access control between the two - just the links on the other site to these documents. | |
Mar 15, 2015 at 13:35 | comment | added | Greg | You don't clarify if the site you are accessing has applied access control measures prior to accessing the document. if an authentication token is present and you access the page and served via secure connection it would be less of an issue | |
Mar 15, 2015 at 11:18 | comment | added | racec0ndition | Well, if u want to prevent https from being subverted or downgraded such as in MITM, set the HSTS header, that will prevent this. Recommend it to the web app in question. | |
Mar 15, 2015 at 10:30 | history | edited | Cybergibbons | CC BY-SA 3.0 |
added 178 characters in body
|
Mar 15, 2015 at 10:17 | comment | added | Cybergibbons | Edited question for clarity. | |
Mar 15, 2015 at 10:17 | history | edited | Cybergibbons | CC BY-SA 3.0 |
added 721 characters in body
|
Mar 15, 2015 at 10:15 | answer | added | sebastian nielsen | timeline score: 1 | |
Mar 15, 2015 at 10:08 | comment | added | Cybergibbons | Possible, yes. Though the thing being protected is very different. | |
Mar 15, 2015 at 9:19 | review | Close votes | |||
Mar 16, 2015 at 5:15 | |||||
Mar 15, 2015 at 8:35 | history | asked | Cybergibbons | CC BY-SA 3.0 |