It's not really "security by obscurity", because the security mechanism is known to all. There's an authentication token that controls access to the image.
There are only two unusual factors. The token is contained in the URL instead of a cookie (which actually reduces the obscurity, but has no other effect). Also, the token is per-resource as opposed to per-user (which has both advantages and disadvantages).
As they say, you can't un-ring a bell. Once someone has seen a file, it could be in their browser cache, they could have saved it, and they might just remember its contents.
This no more prohibits revocation than right-click traps do. It was impossible to stop to begin with.
(Of course, I think you understand this, as you mentioned the browser cache. I'm mentioning this mostly for the benefit of later readers)
Comments
It's not really "security by obscurity", because the security mechanism is known to all. There's an authentication token that controls access to the image.
There are only two unusual factors. The token is contained in the URL instead of a cookie (which actually reduces the obscurity, but has no other effect). Also, the token is per-resource as opposed to per-user (which has both advantages and disadvantages).
It does have the important disadvantage that you can not revoke access to anything. If someone has seen it once, they can see it again.
On the other hand, who cares... it's also in their browser cache
As they say, you can't un-ring a bell. Once someone has seen a file, it could be in their browser cache, they could have saved it, and they might just remember its contents.
This no more prohibits revocation than right-click traps do. It was impossible to stop to begin with.
(Of course, I think you understand this, as you mentioned the browser cache. I'm mentioning this mostly for the benefit of later readers)