3

I overheard the following statement today:

We shouldn't use /api (e.g. in a RESTful URL like /api/v1/users/get) in our RESTful URLs anymore because it makes it easier for people to Denial Of Service attack our site. If we just give it a name like /users/get then people will be less likely to think it's an API and therefore won't be bothered DOS'ing us.

I thought this was a crazy statement and pointed out that large websites like Twitter use this same URL format, to which the person replied

Just because they do it doesn't mean it's ok

Is there any merit whatsoever in this person's statement? I completely disagree with him. I would say that if someone was that intent on DOS attacking our site then a different URL format in our API certainly isn't going to stop them!

  • Assuming you correctly hash password (slow algorithm) your login form would be a nice URL to request unless you have a very solid throttling in place for individual clients AND site wide based on the number of failed login atempts in a certain time interval. – Darsstar Feb 10 '14 at 10:56
  • If it's an API, you probably have documentation online somewhere on how to access it. If someone is running a DDOS they determine the best target, it's unlikely they would miss an API no matter what it's named if it incurred lots of resource usage. – Daisetsu Feb 14 '14 at 19:27
  • 1
    I'm not even clear on why a REST API would somehow be a target for attack, but your "web browser" API wouldn't. Also how the latter would be somehow more effective for a DDOS. – Stephen Touset Feb 14 '14 at 21:45
7

His suggestion is merely Security by Obscurity. As you point out a determined attacker would not be much impaired by this and it risks giving you a false sense of security.

If you are concerned about denial of service attacks you should investigate more robust solutions.

Schneier's opinion on the matter:

I used to decry secret security systems as "security by obscurity." I now say it more strongly: "obscurity means insecurity."

https://www.schneier.com/blog/archives/2014/02/the_insecurity_2.html (February 14, 2014)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.