Ask HN: Is security by obfuscation sufficient?

Re:Ask HN: Is security by obfuscation sufficient? by eli on Monday November 16, 2009 @02:25PM (#945079)

It's not clear what you're trying to secure against. Are you worried about securing a particular image so that only certain designated users can see it? Are you worried about the original name "leaking"? Are you worried about someone iterating through all of your images?

In general, relying on a "secret" URL is not a good way to keep things secret. Google has a nasty habit of finding URLs you thought had no links. Definitely tune your robots.txt to keep the images off legit search engines.

[ Parent | on HN ]

Re:Ask HN: Is security by obfuscation sufficient? by chris100 on Monday November 16, 2009 @02:31PM (#945098)

Definitely tune your robots.txt

But if you put exact URLs in your robots.txt, then a normal person could pick them up from there and access your content.

Make sure you use a directory structure and forbid all files from the content directory :-)

[ Parent | on HN ]

Re:Ask HN: Is security by obfuscation sufficient? by andrewljohnson on Monday November 16, 2009 @05:28PM (#945462)

It's also worth pointing out that only the likes of Google and Yahoo will even look at robots.txt.

Some other crawler may walk in there, then create pages that link your files, and then Google could link those pages, and it's game over.

[ Parent | on HN ]

Re:Ask HN: Is security by obfuscation sufficient? by milestinsley on Monday November 16, 2009 @02:40PM (#945117)

My main concerns are securing a file so only certain designated users can see it. And, yes, someone iterating through them would be bad also!

Thanks for the tip about Google. It would be unacceptable for Google to index these files.

[ Parent | on HN ]