I am looking at enabling a hosted phonebook provided by a hosted VOIP provider.
The phonebook is hosted on a server. The phonebook is accessed via a username / password protected web GUI for inputting contact details, and produces a XML feed where VOIP phones can connect to it so the contacts can be called from the phonebook.
All connections to the server are HTTPS.
The problem is that the VOIP phones cant handle authentication so the XML feed is kept on a long unique 100+ character URL, which is essentially security by obfuscation. If someone gets hold of the URL they have access to the full phonebooks contents.
The VOIP provider has assured me this is secure, as the URL is essentially a password. But I am not sure about this...
Obviously someone could find the URL, which would be hard for them to randomly stumble across, but if they did the contents are unprotected.
But if someone was sniffing traffic on the LAN, the VOIP phones are connected to, would they be able to see the VOIP phones contacting the XML feed, or would the URL they are using be encrypted by virtue of it being SSL ?