Hacker News Reader

Comment by BurningFrog | Hacker News Reader

The possible advantage of the encoding is that it that it can be encrypted and make parameter hacking impossible.

Would have to do the signing server-side, predicated on the server checking the entire state to ensure validity. Such effort being put into preventing parameter-hacking would suggest there are serious vulnerabilities in that website. The URL is meant to be modified by the client.

> The URL is meant to be modified by the client.

Clarification, the human user probably won't want to modify the URL, but the client will.

With something nice like the Google url, I would happily modify it myself.

Harder. Not impossible. Harder. I don't want to make it sound like I am being disagreeable just for the sake of being disagreeable. If there is one thing the past decade has shown, it is that hacking is just a matter of time and whether a determined person is willing to direct resources at it.

I see you, and raise you:

What if they encrypted the parameters with a one-time pad ?

Hmm. Most likely ( if not only ) way to counter that would be social hacking ( because I assume the pad is generated automatically from some source ), which seems like the best way to obtain it. Then again.. I am not an expert in this field ( but we do sometimes use parameters from link for some projects ). Is it refreshed after some time passes ( if so, maybe there is an easier way to just observe what changes )?

One-time pads have to be stored server-side. If you're going to do that, you might as well just store the data itself under a GUID server-side so you avoid network transfers and then put the GUID in the URL.

You don't need to encode it to do that though. You can just sign the URL

Yeah, why not just base64 encode, shove that into a db with a shorter key? I'm pretty positive this is how tiktok works for sharing videos.

Probably don't want to pay for space for unauthed users.

Reply on news.ycombinator.com