4 ms·
UUIDs as tokens? wow.
by kensign 10y ago
UUIDs as tokens? wow.
- bitJericho 10y agoUuid makes a great token.
- koolba 10y ago> Uuid makes a great token. When they're actually unique, sure. If you're UUIDs are the byte representation of something that isn't random (i.e. something not from /dev/urandom) then no they'll suck as much as the source. Generally speaking, what you put in is what you get out.
- mikeash 10y agoThey need to be unique and unguessable, which don't necessarily go together. For example, a version 1 UUID is unique, but is fairly guessable, since it's just a MAC address, a timestamp, and a small random-initialized counter.
- DZittersteyn 10y agoLooking at the reports, the UUID's are xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx, so V4 UUID's, which should be pretty hard to guess (barring bad PRNG, but that's a whole different problem)
- mikeash 10y agoYeah, that gets you 122 bits of entropy (with a good RNG) so that should be fine. I mainly pointed that out just in case anyone assumes "UUID" automatically means "random UUID" and fails to check whether their particular UUID generator uses v4 or something else.