0

This question already has an answer here:

I have a static website and it's security depends on people not knowing that a secret file is at example.com/Path/To/Secret/File.pdf. Assuming that the path to the the file is not randomly generated, is this safe?

Update: the path is not that obscure. It would be like domain.tld/Files/Password.txt. Not anything like GUID or random strings.

marked as duplicate by Xander, Community Dec 7 '16 at 2:03

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3

To answer the question in the title, yes, that's security through obscurity.

While the security community generally frowns upon that, in some situations that can be appropriate - for instance, semi-private files on a CDN, with a long random-ish string in the URI, that need to be accessed by a variety of clients for whom handling authentication is difficult.

Your situation, though, is a bit different, in that you explicitly are not using a hard-to-guess filename. This means that someone who has never been given access to the file still has a reasonable chance of finding it.

A broader problem with this sort of security is that you cannot easily revoke access for specific users. If one person has been granted access, they continue to have access, which can be a problem if, say, they were an employee and they've now left the company. It also allows them to send the link to others, either publicly or privately, and those others will now have access, even if you did not intend to grant it to them. Again, in some situations this is acceptable (if it's a file that isn't frequently updated, they could simply save it onto their computer and achieve the same thing), but this will depend on your situation.

  • Currently, I have a txt full of passwords stored at mydomain.com/passwords.txt. Gonna go change that. – jkd Dec 7 '16 at 0:38
  • @jakekimds https-only, I hope.... – drewbenn Dec 7 '16 at 0:40
  • @drewbenn Not really. But as I said, I changed it to password12345.txt now, so it should be safe. jk I took the file offline, and it wasn't HTTPS because certificates are expensive. – jkd Dec 7 '16 at 0:42
  • 3
    This is getting rather off-topic, but with the advent of Let's Encrypt, money should no longer be considered a reason to avoid implementing HTTPS. – Xiong Chiamiov Dec 7 '16 at 0:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.