Suppose we have website that use MD5 hash in URL like this:
http://somewebsite.com/XXX/
where XXX
is MD5 hash.
Content of this website may have sensitive information like transaction details with personal data.
There is no other authorization to this website, so if you have URL you can access it.
How safe is it? I mean, if no one will share URL with anyone, then can I assume no one will access it?
How much time could it take web crawler, to crawl through all combinations of such url?
I ask because I am using some web shop, that store transaction details with personal data in such manner, I am saying them that it's not secure and someone can view their clients sensitive data, but they are not convinced. To build web crawler it's simple to me, I know how to do this, but I don't know how much time it will crawl through all combinations, maybe at shop they are right? This is not about my website, I am end user of that shop, and I need to convince them they are wrong.