You can use plugin http.upload and its setting random_suffix_len to create hard-to-guess names for uploaded files.
random_suffix_len