2

There's a vendor who sends us reports full of links to articles. Some of these links, especially ones that perform what I'm guessing is an HTTP verb of some kind, look like this:

https://arbitrarynumbers.acronym.website.com/anotheracronym/click?upn=V7nLa9UXJ-2FC89NDFn1UZlmMFXDCeN8q0tH6mY545KyAUaP8HmDtN9T2S-2Bg7aCCMBlSZh11liPowfKxWPna-2FVaptFLOZxqpcD68QrcptgMI1a22Y4XTEZiAeucUWjZAD9sVgV-2Baq0xequM7VcXl-2BmOl3FWqf7MOfWK13WhAyY6ILWhLP7aq99cI0yTYqdDXyfbGSCsAH14unM0mJZPPrnkibqRXOK6AicnwpYyUYWHrrglFkTEp1NUhfexGsfqdAypWPJVWibehmCua8elVvEK3h5UWGEQ-2BcMNXEYYaHh2Mk7e6P0PrboAZkrlVqjZw81_Vf68ZJ5AeUI3LF4CqINVwnqFVd-2FKRV7eRgp7NmpHn0vrNNp-2FS8Dx205CxtKAt8ruN8Tea80o1B2D68NmTEQrbzQbGcouV7k1BM7OghNe6LlIGeA-2B0g3cElmWBAQdEdnWI2eNmj-2FBye8kH4PB-2Bvp5GZihoTPLDhFLu31kSFdBGD5teoPbI-2FY26oYvi9TEWxcsvMtu3BS8V7aM0tKWV6h5D3IUQyv0cgY4liePEMplxsByyFEgJd5mgDyGiI4fFJgxPk529v0OuvuEDbPptklLF1LBT-2F-2Bt-2FOtOcTc-2BgfNAvLEHB8Rizid3vB6a6wd-2FG1PdK8fpMergoZPBy8DG3t143bUrabzZ-2BOvKN5bfzdOO80A-3D (This particular link is one you click to tell them the article wasn't relevant.)

Is this some attempt at hashing or encrypting the contents of the URL so people can't just send them random HTTP DELETE commands, or similar? Or is it some kind of security-by-obscurity? Something else entirely?

1
  • Probably this hash doesn't contains personal information, just some informations about localization and referral
    – Felipe
    Commented Mar 6, 2016 at 3:56

1 Answer 1

7

No. The link propably contains the full url of the article that wasnt relevant, and also user details of the user that sends "this is not relevant", so only those that received the report can tell that "this is not relevant".

Its not security-by-obscurity, rather, its a link with authentication data embedded, so you don't have to type your username/password or ask the company manager to tell "this is not relevant".

The reason to encrypt the url also, is that a integrity-verifying code at the end, can ensure, that authentication data belongning to link 1 cannot be misused to link 2. Eg, when you have clicked that link, then the corresponding article is then marked as not relevant. If some unauthorized individual clicks the link again, it does not matter since the article is already marked as not relevant.

The encryption then prevents someone from changing the article url/article id inside the link so one link cannot be misused to mark another article as not relevant, or misusing the link for other things like unsubscribing or such.

Think the link as this: http://example.org/auth?username=somebody&password=somepassw0rd&action=markasnotrelevant&url=http://www.somenewssite.com/article/article39587395837u59.html&hash=5acf768c5fcafac85afc785fc8c and then you encrypt that with a symmetric algoritm, and then encode as urlsafe base64, before sending it out. Since the server created the encrypted link, the server can also decrypt the information with the same symmetric key, but nobody can abuse the information stored in the link.

It has NOTHING to do with DELETE/PUT and such HTTP verbs. A browser is normally unable to send anything else than GET/HEAD/POST, so the request done is a GET in the above case.

8
  • So then this is a completely legitimate form of security for such situations, not just something hacked together to serve a purpose? I'm curious because I've never seen/noticed URLs composed this way before.
    – thanby
    Commented Mar 2, 2016 at 15:26
  • yes. But they are used in other cases too. For example as email-verify in user registration, you can put the contents of the registration form in such a encrypted link, to avoid having to store anything in database before email is verified. But yes, such links are uncommon, its more common to store a random ID in a database, with fields corresponding to user details and URL and such, and then just have the ID in the link. But such solution does not scale well since then every link ever sent out needs to be stored in database. Commented Mar 2, 2016 at 15:30
  • Looking at the parameter name "upn" I think it's more likely to be a claims token identifying the user. Similar idea but hopefully without anything like a password in there :) Commented Mar 2, 2016 at 15:56
  • Yes but the link must contain the article to be marked as not relevant too. And even if there were a password/password hash there, it would be no harm. That would actually increase security, since if the user changes password, all previous links are automatically invalidated. Commented Mar 2, 2016 at 16:06
  • Could be! The last acronym on the URL could be the article, but there's nothing obvious to indicate the desired action. It seems unlikely that "click" == "not relevant" Commented Mar 4, 2016 at 9:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .