Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I would like to know if I can offer private downloads in my website (only available to certain users) by placing all the files in a /download folder and make sure it doesn't show the index of all the files with the .htaccess option: Options -Indexes.

That way, only users with the complete address of the file would be able to download a certain file.

Is there any problem with this method?

share|improve this question
    
How secret do they have to be? Are these files with personal information that users would be upset if somebody else were able to download? –  Stephen Ostermiller Nov 5 '13 at 0:59

3 Answers 3

If you want to make it difficult for users to download files meant for other people, then using random names is probably good enough. But it will only make it difficult, it won't prevent any of the following:

  • A user sharing their download link with others
  • Search engines indexing the download links that they are able to find
  • Somebody figuring out the pattern you use and downloading other files

"Secret" URLs tend to leak in some surprising ways. For example, one of your downloads is opened in a browser window and somebody clicks on a link in it (maybe even in a PDF), the browser will send the secret URL as a referrer to the site that was clicked on.

I wouldn't rely on secret file names for any files that contain data that user would be upset about having shared with others.

share|improve this answer

This is called "security by obscurity". This is essentially no security at all.

Security through obscurity is a pejorative referring to a principle in security engineering, which attempts to use secrecy of design or implementation to provide security. A system relying on security through obscurity may have theoretical or actual security vulnerabilities, but its owners or designers believe that if the flaws are not known, then attackers will be unlikely to find them. A system may use security through obscurity as a defense in depth measure; while all known security vulnerabilities would be mitigated through other measures, public disclosure of products and versions in use makes them early targets for newly discovered vulnerabilities in those products and versions. An attacker's first step is usually information gathering; this step is delayed by security through obscurity. The technique stands in contrast with security by design and open security, although many real-world projects include elements of all strategies.

Security through obscurity has never achieved engineering acceptance as an approach to securing a system, as it contradicts the principle of "keeping it simple". The United States National Institute of Standards and Technology (NIST) specifically recommends against security through obscurity in more than one document. Quoting from one, "System security should not depend on the secrecy of the implementation or its components."

It is analogous to a homeowner leaving the rear door open, because it cannot be seen by a would-be burglar.

share|improve this answer
    
On most sites a random 32-character (or less) cookie identifies your session. Anyone with that chain of characters can impersonate you (do privileged operations as you). This is considered secure enough. - Additional measures like session-IP binding won't add an order of magnitude. –  vbence Nov 5 '13 at 12:33
    
The question asker doesn't mention cookies at all or anything other security measures at all so your comment doesn't make sense. –  John Conde Nov 5 '13 at 12:39
    
I meant that 32 random characters are considered something that can not be guessed by a third party (secure enough). (Regardless of it being stored a cookie, or being part of the URL). –  vbence Nov 5 '13 at 12:47
    
No no no no no. Just because it's hard to guess doesn't make it secure. You have to get that out of your head. This is no security. If the content needs to be secured real security measures should be taken. Simply hiding it out of plain site is not security. –  John Conde Nov 5 '13 at 12:51

As John mentioned, this is simply security through obscurity. What that means is it's basically not security at all.

Once somebody knows the URL for one of the files there is nothing you can do to stop them sharing it and giving it to other people. Then anyone can download it and you can't stop them.

Also, if somebody downloads several files, they may be able to determine a naming convention. Perhaps your files are called file1, file2, file3 etc... Once someone learns there is a pattern they could enumerate the rest of your files.

Failing that, unless your file names are incredibly random, someone could simply write a script to brute force guess your file names.

The point is, if you need them to be secure, make them secure. By hiding them (obscuring them) you are not making them secure. Obscurity is not security.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.