3

I overheard the following statement today:

We shouldn't use /api (e.g. in a RESTful URL like /api/v1/users/get) in our RESTful URLs anymore because it makes it easier for people to Denial Of Service attack our site. If we just give it a name like /users/get then people will be less likely to think it's an API and therefore won't be bothered DOS'ing us.

I thought this was a crazy statement and pointed out that large websites like Twitter use this same URL format, to which the person replied

Just because they do it doesn't mean it's ok

Is there any merit whatsoever in this person's statement? I completely disagree with him. I would say that if someone was that intent on DOS attacking our site then a different URL format in our API certainly isn't going to stop them!

Improve this question
3
  • Assuming you correctly hash password (slow algorithm) your login form would be a nice URL to request unless you have a very solid throttling in place for individual clients AND site wide based on the number of failed login atempts in a certain time interval.
    – Darsstar
    Feb 10, 2014 at 10:56
  • If it's an API, you probably have documentation online somewhere on how to access it. If someone is running a DDOS they determine the best target, it's unlikely they would miss an API no matter what it's named if it incurred lots of resource usage.
    – Daisetsu
    Feb 14, 2014 at 19:27
  • 1
    I'm not even clear on why a REST API would somehow be a target for attack, but your "web browser" API wouldn't. Also how the latter would be somehow more effective for a DDOS.
    – Stephen Touset
    Feb 14, 2014 at 21:45

1 Answer 1

Reset to default
7

His suggestion is merely Security by Obscurity. As you point out a determined attacker would not be much impaired by this and it risks giving you a false sense of security.

If you are concerned about denial of service attacks you should investigate more robust solutions.

Schneier's opinion on the matter:

I used to decry secret security systems as "security by obscurity." I now say it more strongly: "obscurity means insecurity."

https://www.schneier.com/blog/archives/2014/02/the_insecurity_2.html (February 14, 2014)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .