Exactly how un-secure is this scenario, please note that I can't use SSL due to restrictions in the website application (yeah go figure!):
How easy is it for someone to intercept the logging-in users credentials? Given that the url would not be known?
Like I say we would use SSL but the app does not work well under an SSL connection.
In addition to what's already been said about traffic interception when not encrypted, perhaps your biggest problem is security through obscurity.
You're trusting your users not to talk.
You're giving a "secret" domain name to people who will be using it in public? Are you users really going to be concerned about security? I know people who don't even guard their ATM PIN. And what about users that are fired or quit? Or talk to you on the phone for support about some issue and just blah blah blah in public your secret URL?
And if you have this domain on the Internet, it's going to be in a database and searched by spiders for search engines. Something's bound to show up somehow.
In short if you have users out there and you're relying on them not to talk about it, you are going to have a problem.
Of course that's in addition to shoulder surfing, man in the middle interception, etc...
Short answer: it's highly highly insecure.
How easy is it for someone to intercept the logging-in users credentials? Given that the url would not be known?
It would be trivial to intercept the login credentials if you are not encrypting traffic. An attacker would not need to know the URL -- that would be a non-issue. A customer at Star Bucks, using open wifi, would transmit everything unencrypted, including username, password and your "unknown" URL, etc, for anyone with a sniffer to see. The same thing applies for users on a non-switched, wired network. With a wired switched network an attacker could use a mirrored port or similar.
Fix your app to work with SSL.
