I have heard that "Security by Obscurity" is bad. And I have always agreed with it.
But today I had a coworker disagree when in consideration of links. He was arguing that a link with obscure values in it is as good as a password and is more convenient than needing a custom login. (More than just a Guid, he was arguing generated key values intended to be non-predictable.)
In an attempt to prove him wrong, I did the math. A standard English QWERTY keyboard has:
- 52 chars
- 28 special chars
- 10 numbers
That is a total of 90 possible values for each char in a link. If a link has between 8-15 chars that are the "Obscure" part, that means there are are (90^15)-(90^8) possible obscure values. That is a total of 205,891,132,094,644,695,327,900,000,000 possible values.
If I setup an server farm attempting to sniff out these links, I would need to make 6,528,764,970,022,979,938 requests a millisecond to try them all in a year. (Which would trigger DDOS prevention protocols.) Assuming that I would use up a max of 1 million of the possible values, that means that the odds of guessing a correct value is 0.0000000000000000000048%.
As I look at this, it seems similar in nature to the security levels of using a password.
So, assuming the link itself is given out in a manner as secure as a password is given out, it seems that an "Obscure Link" IS secure.
Have I misunderstood "Security by Obscurity" when I included obscure links in that grouping? (I am starting to think this, because it is not the way the link is constructed that is the security, is the the "password" embedded into the link that provides the security.
My question here is to ask "am I missing something?" Is there a reason that "Obscure Links" should not be used as security?