securityadminsecurity-by-obscurity

I want to use security through obscurity for the admin interface of a simple website. Can it be a problem?


For the sake of simplicity I want to use admin links like this for a site:

http://sitename.com/somegibberish.php?othergibberish=...

So the actual URL and the parameter would be some completely random string which only I would know.

I know security through obscurity is generally a bad idea, but is it a realistic threat someone can find out the URL? Don't take the employees of the hosting company and eavesdroppers on the line into account, because it is a toy site, not something important and the hosting company doesn't give me secure FTP anyway, so I'm only concerned about normal visitors.

Is there a way of someone finding this URL? It wouldn't be anywhere on the web, so Google won't now it about either. I hope, at least. :)

Any other hole in my scheme which I don't see?


Solution

  • Well, if you could guarantee only you would ever know it, it would work. Unfortunately, even ignoring malicious men in the middle, there are many ways it can leak out...

    1. It will appear in the access logs of your provider, which might end up on Google (and are certainly read by the hosting admins)
    2. It's in your browsing history. Plugins, extensions etc have access to this, and often use upload it elsewhere (i.e. StumbleUpon).
    3. Any proxy servers along the line see it clearly
    4. It could turn up as a Referer to another site