-1

I don't have much server security experience, so just looking for an answer (I've searched and have gotten mixed results).

I have a server that stores a bunch of data with MySQL. I want to create an account login system on it that sends an email verification link. Currently the test email sends a link that looks something like this (not an actual link):

https://58.87.12.222/SomeFolder/VerifyNewAccount.php?idCode=someThing

Is that bad security wise?

Can someone do something bad knowing the ip address and other info the link contains?

Can someone "listen" on that address to gain incoming login info?

Is there an easy way to hide it considering my lack of knowledge?

Improve this question
2
  • How do you think anything communicates with your server? By its IP address of course. Yes, it's best practice to use a proper host name, but if you do that you're not hiding anything.
    – EEAA
    Jun 16, 2017 at 23:41
  • 1
    Security through obscurity is not really security. Your server should be secure enough that even if someone knows exactly what's on it they still can't get access to any protected resources. Getting to 100% of that can be tricky, especially with things like SSL keys, but you should be able to get close.
    – Tim
    Jun 17, 2017 at 0:57

2 Answers 2

Reset to default
1

The only reason it could be considered a bad practice is because you cannot get a signed certificate from a widely-trusted CA for an IP address.

Just get a proper domain. They're nearly free these days.

Improve this answer
1
  • 3
    Also, of course using an IP address instead of a host name makes it more difficult to switch servers, as you now also have to change everything that references the IP address instead of just updating a single record in DNS.
    – Sven
    Jun 17, 2017 at 0:23
0

There are several answers to your questions:

You have asked if someone can do something bad knowing the IP address and other info in the link. (Your link uses an IP address, and the full path of the PHP file, and the idCode parameter.) There is nothing implicitly insecure about using any of those things. However, whether or not someone is able to do something bad depends a great deal on the exact contents of the VerifyNewAccount.php script and how idCode=someThing are actually used. Having that info is not insecure all by itself, unless the script allows that information to be used improperly (the programming details are beyond the scope of this question, and would be more appropriate for another question based on the contents of your PHP script).

You have also asked if someone can "listen" on that address. No one can listen on that address simply by knowing what it is. However, this does not rule out the possibility of a man-in-the-middle-attack (again, the networking details are beyond the scope of this question, and would be more appropriate for another question based on your networking architecture).

Really, there is nothing you can possibly "hide" in this link that cannot be revealed using elementary networking tools. (In fact, you MUST have all the parts revealed or else your system could not be used at all.)

Considering your lack of knowledge, keep on asking questions like this, and keep on examining each and every part of your system as it is built. There is nothing magical about security, but you must keep on asking questions and examining and tightening weak points.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .