I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in.

Someone suggested that we make a token from this: base64urlencode(md5("salt-adid"))

  • adid is information known by the user.
  • salt is just a secret word.

Given this is this solution secure? The user can know the adid.

Will it be possible for a malicious user to calculate the url for stopping an ad?

How can this be change to be more secure?

EDIT: Xander pointed out that something was unclear and I will try and elaborate.

"It's not clear to me why you need a token at all. Is this just for some logged out users rather than all logged out users?"

It should not be possible for any user to stop the ad just to owner. We will be sending the url to the owner so he/she can use it if they want to stop the ad. So it is just for some logged out users.

  • 2
    Based on the scenario you describe, you are not actually using a logged out user, but rather a second login system with a cookie persisted session that doesn't actually require a login to start it. Aug 28 '14 at 14:14
  • I agree with AJ, are you saying that you want the publisher to turn on and off some value without logon? Without logon you are just relying on security by obscurity and could use any value. Please add more details to clarify.
    – Eric G
    Aug 28 '14 at 16:21
  • What type of details do you need Eric? =)
    – Anders
    Aug 29 '14 at 8:26

Yes, if the "salt" is a secret word, it is possible for a user to calculate the hash by running a simple dictionary attack until they come up with the correct hash for their adid.

It's not clear to me why you need a token at all. Is this just for some logged out users rather than all logged out users?

Regardless, if you do need to provide the user with a token that they can't duplicate, it needs to have a message authentication code. If it's not secret (which it doesn't seem to be, since you said the adid which the user already knows will suffice) then use a MAC algorithm such as HMAC to ensure it can't be tampered with or forged.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.