This article is important, but seems a little technically sloppy. The issue isn't about autoincremented IDs, but the fact that they are used as external identi

This article is important, but seems a little technically sloppy. The issue isn't about autoincremented IDs, but the fact that they are used as external identifiers. The specific reason they shouldn't be used is that they are guessable. It also confuses the concept of a GUID a little, I think. That refers to a global UID, which could reasonably be a URL+autoincremented number: global and unique. But guessable. Which is the core issue. I try to consider external IDs like passwords: create a cryptographically strong hash, using some salt, and externalize that.