Linked Questions
12 questions linked to/from Is including a secret GUID in an URL Security Through Obscurity?
20
votes
1
answer
6k
views
Use of obscure URL for security [duplicate]
My hosting provider is offering an infrastructure-as-a-service (IaaS) product administered via a web interface, where the administrator can create and destroy virtual machines.
To access the web-...
5
votes
3
answers
5k
views
Is random URL token secure enough for file attachments and other user content? [duplicate]
Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
- 2,267
1
vote
1
answer
2k
views
Is it secure to have public access to the file on S3 with `secret` url? [duplicate]
For example https://s3-eu-west-2.amazonaws.com/mybucket/620f5cb4132cf1b4619503ece569599e
This is a private file, I send to the web-browser through https link to that private file - but this file is ...
- 117
0
votes
1
answer
445
views
The security of an unique URL parameter [duplicate]
Take for example a simple messaging system. Users can send each other personal messages. When reading a personal message sent to you, the URL would be something like http://www.example.com/messaging....
- 1,047
0
votes
1
answer
248
views
Is an unknown directory structure considered security by obscurity? [duplicate]
I have a static website and it's security depends on people not knowing that a secret file is at example.com/Path/To/Secret/File.pdf. Assuming that the path to the the file is not randomly generated, ...
- 119
0
votes
0
answers
191
views
HTTP Basic Authentication vs. obscure filename [duplicate]
I'm setting up a service which allows a single 3rd party to access a file over HTTPS. The only security mechanism the 3rd party supports is Basic Authentication.
To reduce complexity, I was going to ...
134
votes
4
answers
30k
views
Is it safe to include an API key in a request's URL?
Lately I've seen plenty of APIs designed like this:
curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY"
Isn't it elementary that passing an API key in a query string as a part of ...
- 2,257
4
votes
2
answers
2k
views
S3 Bucket Name Obscurity as Security
Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. *
Can I assume that a public S3 ...
0
votes
2
answers
368
views
Is Link Obscurity as a Security Practice Bad?
I have heard that "Security by Obscurity" is bad. And I have always agreed with it.
But today I had a coworker disagree when in consideration of links. He was arguing that a link with ...
- 101
-4
votes
1
answer
319
views
Does using a long, un-guessable link protect a page? [closed]
If I use a link like this:
www.example.com/vjbvhagwi74g3577384hqujvbgp39843q9-8q24380gfbqp29-q2--2=08h49h24tt982uh3...
Will the infomation be safe?
0
votes
1
answer
398
views
Risks of sharing information just "protected" by a unguessable url [duplicate]
I recently started to use grafana to visualize a lot of different metrics. Grafana also enables me to share dashboard snapshots directly via a link. Which is pretty comfortable since I can share the ...
1
vote
1
answer
68
views
What are the security risks of only using an id in the url to protect the content?
I'm building a note-taking app, when a user writes a note an id is generated and I redirect them to a page where they can see its content with a URL like /note/DXSt832pS5iLuos6uxBn. What are the ...
- 123