I know that this question is a little bit on the side of Opinion/Discussion, but I think there's a provable answer to it.
I think the common view of "Security Through Obscurity" is that the security will only hold up as long as an attacker cannot guess the way in.
In environments where massive attacks or common attack vectors are known, this is often much simpler than many people believe.
However, I think a large number of people do not classify requiring a username/password combo as requiring as a version of "Security through obscurity"
My question is this:
What (security) difference (if any) is there between the following two urls with respect to security (please note caveats listed below):
- [encrypted scheme/protocol SSL]://[user]:[password]@[domain]
- [encrypted scheme/protocol SSL]://[domain]/[user][password]
- Assume that these urls are being accessed by a low-level HTTP client, NOT a web browser. (i.e. the client is not keeping a record of requests, and is trusted -- I know that low-level != "trusted", but I'd like to factor our browser caching as a difference in this question).
- I know that there are known ways to "predict" GUIDs that might have been generated if you have sufficient knowledge of the guid's source machine, and the time (and probably other factors). I do not know if you can extract this information from a sample guid. Assume that Guids are generally not predictable.
- Even though I've already attempted to address this with 1, let me be clear: Humans never directly interact with these URLs (or even see them without digging into a compiled application)
Is the second URL form an example of Security Through Obscurity? Or simply less secure because of the fewer protections afforded by the client?