Linked Questions

49
votes
6answers
6k views

Is a website published in an obscure directory comparably secure to being placed behind a login? [duplicate]

Let's say I create a microsite for a client that contains confidential business information. We need to place this in a location the client can access, in order for them to approve for launch. If we ...
2
votes
1answer
902 views

Is a long, random string in a URL considered adequate protection from unauthorised access? [duplicate]

I have recently had to submit a number of confidential PDF documents to a website. These documents contain more than enough information to use in identity theft, and I can conceive how others using ...
3
votes
1answer
336 views

Is it okay to keep .zip files in the public_html folder? [duplicate]

My company website just take copies of the public html folder and keep zip files as backup in the same folder, I want to know if this is secure or not ? Because other people don't know the name for ...
1
vote
0answers
324 views

Using UUIDs for non-guessable URLs [duplicate]

How safe is using UUIDs as URL identifier for non-guessable IDs? Specifically UUIDs generated by Python's uuid4() function, using base64 encoding. E.g. https://example.com/content/...
0
votes
1answer
164 views

Risks of sharing information just “protected” by a unguessable url [duplicate]

I recently started to use grafana to visualize a lot of different metrics. Grafana also enables me to share dashboard snapshots directly via a link. Which is pretty comfortable since I can share the ...
0
votes
1answer
54 views

Downloading a file on my website, with and without a secret. A room for improvement? [duplicate]

I'm trying to create a simple download system as a part of my website. Is there anything insecure in this route: GET https://my_website.com/downloads?file_id=AAA&user_id=BBB&secret=CCC ...
0
votes
0answers
59 views

Does random file name is hackable? [duplicate]

I have a bit concern about my company file is storing at cloudfront.net its link look something like https://d1ret2xs1rit6.cloudfront.net/money-trans/e9709405f3459.pdf
92
votes
8answers
16k views

Can secret GET requests be brute forced? [duplicate]

Say, I have on my server a page or folder which I want to be secret. example.com/fdsafdsafdsfdsfdsafdrewrew.html or example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html If the ...
5
votes
6answers
811 views

Is a password really necessary? [closed]

For the purposes of security, is there any difference in having a 50 character randomly-generated secret username accompanied by a 50 character randomly-generated secret password, versus a 100 ...
20
votes
1answer
5k views

Use of obscure URL for security [duplicate]

My hosting provider is offering an infrastructure-as-a-service (IaaS) product administered via a web interface, where the administrator can create and destroy virtual machines. To access the web-...
14
votes
2answers
7k views

Is it safe to rely on UUIDs for privacy?

I'm uploading files on S3, where the filename is a UUID. All files uploaded are publicly read/write, however these files are considered private to users. Is it possible for someone to guess a UUID, ...
1
vote
1answer
2k views

UUID in URL - how safe from accidental discovery is my proposed solution?

Here is what I want to do: We create reports for customers, normally we send them as pdf to our customer who then shares them with colleagues across his company. We want to switch now to digital ...
0
votes
2answers
911 views

What is the purpose of HTTPS GET vs POST requests when certificate pinning?

I have a mobile app which uses public key pinning to make sure that I only connect to servers from my CA. This works great with https, and it makes it so that nobody can really proxy my server and ...
3
votes
2answers
129 views

Can a URL that has no links to it be discovered? [duplicate]

Say there is a URL example.com/abunchofrandomsymbols and there are no links to it anywhere on the internet. Could it be discovered somehow? My guess is a browser like Google Chrome could report it to ...
1
vote
2answers
127 views

Can random subdomain naming enhance security?

I have a bunch of services which I want to group under a subdomain. Somehow 2-factor authentication is not possible to identify the users of these services. I have a thought to have randomly named ...

15 30 50 per page