Short, Clean URIs Are More Secure

There are lots of reasons to use clean, short, readable URIs. Search engines like them. People have some hope of dictating or typing them correctly. Email clients are less likely to mung or truncate them. They give people navigational cues and an extra way to navigate a website. You can even fit them on one billboard (unlike say this one).

One generally ignored advantage is security.

Many phishing, XSS, CSRF and all URI exploits rely at least in part in part on putting stuff the user does not understand in the URI.

Here are a few real URIs from popular websites all found inside a minute within 3 clicks of the home page:

Having let people get used to that sort of garbage from sites that they should be able to trust, you can’t really be surprised that normal people can’t tell the difference between an XSS attack hidden in URL encoded JavaScript and a real, valid, safe URI. Even abnormal people who can decode a few common URL encodings in their heads are not really scrolling across the hidden nine tenths of the address bar to look at that lot.

It won’t help everybody. There are always going to be people who are happy to believe that their bank sends them email from a free address like, and sufficiently sophisticated social engineering is always going to work on some people, some of the time, but the sites that are particularly popular with phishing attacks are making it unnecessarily easy.

If commonly used sites had short, sensible URIs it would not take genius on the part of slightly cynical users to notice that every real bank URI they had seen in the past looked something like so the 300 character monstrosity full of percent symbols and ampersands that they were being presented with is a little on the fishy side.

Now, go and tidy your room.

50 thoughts on “Short, Clean URIs Are More Secure

  1. Pingback: Some Guy Ranting » Blog Archive » Following the big dogs on web application security

  2. Greetings I am so delighted I found your weblog, I really found you by error, while I was browsing
    on Aol for something else, Anyways I am here now and would just
    like to say thank you for a fantastic post and a
    all round exciting blog (I also love the theme/design),
    I don’t have time to look over it all at
    the moment but I have saved it and also added in
    your RSS feeds, so when I have time I will be back to read much more, Please do
    keep up the excellent work.

  3. Good day! This is kind of off topic but I need some advice from an established blog.
    Is it very hard to set up your own blog? I’m not very techincal but I can figure things out pretty
    fast. I’m thinking about setting up my own but
    I’m not sure where to begin. Do you have any tips or suggestions?

  4. Wow that was unusual. I just wrote an incredibly long comment but after I clicked submit my comment didn’t show up.
    Grrrr… welll I’m not writing all that over again. Regardless, just wanted to say superb blog!

    Here is my weblog :: cure insomnia

  5. Fantastic goods from you, man. I’ve have in mind your stuff prior
    to and you’re simply too wonderful. I actually like what you have bought here,
    certainly like what you are saying and the best way through which you are
    saying it. You are making it entertaining and you still take care of
    to stay it wise. I can’t wait to read much more
    from you. This is actually a terrific website.

    Feel free to surf to my blog: ways to improve your credit

  6. Most kids will groan at the sight of a plate of vegetables or fruit for a snack, but how
    different their reaction is when they. Grow
    your own tomatoes, lettuce, cucumbers, carrots, spinach.
    You may berate yourself because you didn’t handle the
    situations effectively.

    my web site … get back together poems, Lilly,

  7. You can correspond with them and find out if they can ship the required model to your place.
    Course 3 ‘ This course covers elementary fire fighting
    and fire prevention. The cost may seem higher than regular villa stay or a hotel but the stay is worth it.

    My web-site … private yacht athens car rental greece [Blair]

  8. Hey there this is kinda of off topic but I was wondering if blogs use
    WYSIWYG editors or if you have to manually code with HTML.

    I’m starting a blog soon but have no coding know-how so I wanted to get advice from someone with
    experience. Any help would be enormously appreciated!

  9. Thank you a lot for sharing this with all folks you really understand what you are talking about!
    Bookmarked. Please also consult wwith my website =). We may have
    a link exchange agreement among us

  10. You’re so cool! I don’t suppose I’ve truly read something like this before.
    So great to find somebody wigh a few genuine thoughts on this topic.
    Really.. thanks for starting this up. This website is something that is needed on the internet, someone wih some originality!

  11. Pingback: madu penyubur kandungan asli

  12. There are a number of ridiculous comments above that seem like they were written by grade schoolers. I’m buying an sd40 in two days only because EVERY ounce of research I’ve done on them claims they’re great, reliable guns. Literally, I’ve read a hundred articles by gun review guys who all rave about this gun chewing up any ammo you throw in it with 0 failure.
    Levné Běžecké Boty Nike Pánské

  13. Thanks for every other informative blog. Where else could
    I get that kind of information written in such a perfect method?
    I have a undertaking that I’m simply now working on,
    and I’ve been at the look out for such info.

  14. Thanks , I have recently been searching for information approximately this
    subject for a long time and yours is the best I’ve discovered till now.
    However, what in regards to the conclusion? Are you positive concerning the supply?

  15. Great beat ! I wish to apprentice while you amend your web site, how can i subscribe for a blog site?
    The account aided me a acceptable deal. I had been tiny bit acquainted of this
    your broadcast offered bright clear idea

Leave a Reply

Your email address will not be published. Required fields are marked *