News for hackers. Stuff that matters.

A comment on Teenager facing prison for downloading unsecured files from government website. Parent comment

Re:Teenager facing prison for downloading unsecured files fr... by goshx on Monday April 16, 2018 @06:53PM (#16853652)
If things should be secure, they should be behind authentication and authorization for that content. To argue about what is the best ID to be used is just trying to fix what is not broken, IMHO.
[ Parent | on HN ]
Re:Teenager facing prison for downloading unsecured files fr... by quickthrower2 on Monday April 16, 2018 @07:40PM (#16854016)
Security is multi layered.
[ Parent | on HN ]
Re:Teenager facing prison for downloading unsecured files fr... by scrumption on Monday April 16, 2018 @08:19PM (#16854268)
Obscurity is not a security layer.
[ Parent | on HN ]
Re:Teenager facing prison for downloading unsecured files fr... by rurounijones on Monday April 16, 2018 @09:58PM (#16854786)
Obscurity is a perfectly fine security layer as you said yourself (i.e. it is one of many layers).

Relying ONLY on obscurity is a failure.

[ Parent | on HN ]
Re:Teenager facing prison for downloading unsecured files fr... by Someone1234 on Monday April 16, 2018 @08:50PM (#16854435)
So a password or private encryption key isn't security?
[ Parent | on HN ]
Re:Teenager facing prison for downloading unsecured files fr... by pluma on Tuesday April 17, 2018 @04:13AM (#16856453)
What is a UUID if not a fairly predictable object-based shared authorization token?

EDIT: I'm mostly kidding.

[ Parent | on HN ]
Re:Teenager facing prison for downloading unsecured files fr... by quickthrower2 on Tuesday April 17, 2018 @05:17AM (#16856702)
Just call it an object-specific API key, that forms part of the URI instead of being a header value. Since we are using https it's all good.
[ Parent | on HN ]