4 ms·
Ehm, this is just a fundamental misunderstanding. UUIDs are not and are not supposed to be random. They are not even unique. They are just reasonably likely to
by krig 8y ago
Ehm, this is just a fundamental misunderstanding. UUIDs are not and are not supposed to be random. They are not even unique. They are just reasonably likely to be unique enough for most purposes.
- whack 8y agohttps://en.wikipedia.org/wiki/Universally_unique_identifier#Version_4_(random) https://en.wikipedia.org/wiki/Universally_unique_identifier#... V4 UUIDs are supposed to be random.
- beefhash 8y agoIf you parse out the UUIDs presented (e.g. 4331cc4c-1d91-11e9-be2c-45923c63e8a2), you'll see there are a lot of version 1 UUIDs.
- whack 8y agoThat's a bug/feature of the specific MySQL implementation. If you used a different implementation like the following, you can generate V4 cryptographically strong random UUIDs https://www.tutorialspoint.com/java/util/uuid_randomuuid.htm https://www.tutorialspoint.com/java/util/uuid_randomuuid.htm
- crehn 8y agoAnd MySQL docs clearly state they're using v1.
- krig 8y agoNope. The V4 RFC does specify and recommend a method for generating UUIDs that uses randomness, but it also provides other methods, and explicitly warns against relying on the UUID being random: "Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access), for example."
- bpicolo 8y ago> Do not assume You can't assume, but you can certainly check for a given implementation. Plenty of implementations do provide secure randomness, e.g. Ruby's SecureRandom[0]. https://ruby-doc.org/stdlib-1.9.3/libdoc/securerandom/rdoc/SecureRandom.html#method-c-uuid https://ruby-doc.org/stdlib-1.9.3/libdoc/securerandom/rdoc/S...
- krig 8y agoSure, if you are really determined to do it, nothing can stop you from finding a way to shoot yourself in the foot. I still maintain that depending on randomness in UUIDs is conceptually misuse, even if technically achievable.
- whack 8y agoHow are you shooting yourself in the foot. Regardless of what approach you take, you're placing your trust in some random generator. Whether this trusted generator is formatting its output in the form of raw 0s and 1s, or an alphanumeric string, or UUIDs, is absolutely irrelevant.
- krig 8y agoYou are shooting yourself in the foot by calling your random number an UUID or thinking that randomness is a property of UUIDs. This is going to come back and bite you in some way, one example would be where later changes to the code (by someone who knows about UUIDs but not the assumption that they should be random) mixes in a v1 UUID...
- whack 8y agoYou're attacking a strawman. No one is saying that all UUIDs are generated by CSPRNGs. Only that some are. Regardless of what method you use to generate secrets, someone could later change the code to generate the same secret using a non-cryptographically-secure RNG. By that logic, alphanumeric strings should not be used as secrets either.