Linked Questions

48
votes
6answers
6k views

Is a website published in an obscure directory comparably secure to being placed behind a login? [duplicate]

Let's say I create a microsite for a client that contains confidential business information. We need to place this in a location the client can access, in order for them to approve for launch. If we ...
8
votes
4answers
2k views

Can I replace username and password with a long random text in URL? [duplicate]

Scenario One customer is facing a problem with his users: they use a (web) service a few times per year and they forget their credentials very often. There is a standard password recovery procedure ...
2
votes
1answer
550 views

Is having a GUID in a https url secure enough? [duplicate]

Is having a GUID in a https url secure enough? Are there any security risks of using this way of authenticating users? https://mywebsite.com/......?Guid=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Also what ...
1
vote
2answers
85 views

How (un)safe is it to protect an admin page with a simple query-string password? [duplicate]

I have a very simple admin web page that simply displays feedback messages left by users of my mobile app. The messages are sent from the app to a web server, and to view the messages one needs to ...
-1
votes
1answer
106 views

Passing a secret in url: as a part of the url or query string? [duplicate]

If I need to make get request to an html page and thus pass a secret via the url using https, is it true that I'd need to pass it in a query string versus a part of a path url? my_domain.com/some_url/...
0
votes
0answers
20 views

Would a HTTPS protected URL be secure in the following circumstances? [duplicate]

I am looking at enabling a hosted phonebook provided by a hosted VOIP provider. The phonebook is hosted on a server. The phonebook is accessed via a username / password protected web GUI for ...
92
votes
8answers
16k views

Can secret GET requests be brute forced? [duplicate]

Say, I have on my server a page or folder which I want to be secret. example.com/fdsafdsafdsfdsfdsafdrewrew.html or example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html If the ...
18
votes
4answers
10k views

Can URLs be sniffed when using SSL? [duplicate]

I know that http requests can be sniffed, so sniffer can see the requested URL from the victim. So 2 days ago I my bank made me a web-account to see, send money etc... The thing I saw is my session ...
0
votes
1answer
792 views

Is SSL + DNScrypt enough to hide visited domains from my ISP?

I've been using VPN lately which I configured on Ubuntu machine in Germany, and I do not feel comfortable using it because of high latency. So I found DNScrypt. Since I only want to keep my browsing ...
1
vote
1answer
957 views

Is it secure to have public access to the file on S3 with `secret` url? [duplicate]

For example https://s3-eu-west-2.amazonaws.com/mybucket/620f5cb4132cf1b4619503ece569599e This is a private file, I send to the web-browser through https link to that private file - but this file is ...
0
votes
1answer
429 views

How to obfuscate outgoing traffic if we don't want to use VPN? [duplicate]

If we say that I cannot trust my internet-service-provider regarding privacy, how can I obfuscate the outgoing traffic on my line? So the ISP will not see that what am I actually doing. Randomly ...