Linked Questions

92
votes
8answers
17k views

Can secret GET requests be brute forced? [duplicate]

Say, I have on my server a page or folder which I want to be secret. example.com/fdsafdsafdsfdsfdsafdrewrew.html or example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html If the ...
77
votes
7answers
19k views

Are random URLs a safe way to protect profile photos?

I would like to move from sequential to random user IDs, so I can host profile photos publicly, i.e. example.com/profilepics/asdf-1234-zxcv-7890.jpg. How long must user IDs be to keep anyone from ...
16
votes
3answers
4k views

Are secret URLs secure over HTTPS? [duplicate]

Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread. What level of ...
20
votes
1answer
6k views

Use of obscure URL for security [duplicate]

My hosting provider is offering an infrastructure-as-a-service (IaaS) product administered via a web interface, where the administrator can create and destroy virtual machines. To access the web-...
4
votes
3answers
4k views

Is random URL token secure enough for file attachments and other user content? [duplicate]

Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
1
vote
2answers
4k views

Find unlisted web pages on a site? [duplicate]

If I have a website with an index.html page that was just a landing page with no other links, and I also have another html page hosted on the same domain that has no links to it, is there any way ...
3
votes
2answers
330 views

Can a URL that has no links to it be discovered? [duplicate]

Say there is a URL example.com/abunchofrandomsymbols and there are no links to it anywhere on the internet. Could it be discovered somehow? My guess is a browser like Google Chrome could report it to ...
15
votes
4answers
3k views

(How) Can outsiders discover the pages that are being hosted on my server?

I have a web site hosted from my server. Sometimes, I upload database manipulation scripts to a folder which is three levels deep in the website and run them using my web browser. These scripts ...
2
votes
2answers
501 views

Can random subdomain naming enhance security?

I have a bunch of services which I want to group under a subdomain. Somehow 2-factor authentication is not possible to identify the users of these services. I have a thought to have randomly named ...
0
votes
2answers
160 views

Is Link Obscurity as a Security Practice Bad?

I have heard that "Security by Obscurity" is bad. And I have always agreed with it. But today I had a coworker disagree when in consideration of links. He was arguing that a link with ...
0
votes
1answer
216 views

Is an unknown directory structure considered security by obscurity? [duplicate]

I have a static website and it's security depends on people not knowing that a secret file is at example.com/Path/To/Secret/File.pdf. Assuming that the path to the the file is not randomly generated, ...
-4
votes
1answer
247 views

Does using a long, un-guessable link protect a page? [closed]

If I use a link like this: www.example.com/vjbvhagwi74g3577384hqujvbgp39843q9-8q24380gfbqp29-q2--2=08h49h24tt982uh3... Will the infomation be safe?
0
votes
1answer
250 views

Risks of sharing information just "protected" by a unguessable url [duplicate]

I recently started to use grafana to visualize a lot of different metrics. Grafana also enables me to share dashboard snapshots directly via a link. Which is pretty comfortable since I can share the ...