3 ms·
> Do not assume that UUIDs are hard to guess; they should not be used as security capabilities https://news.ycombinator.com/item?id=10631806 https://news.ycomb
by jjjbokma 7y ago
> Do not assume that UUIDs are hard to guess; they should not be used as security capabilities
https://news.ycombinator.com/item?id=10631806 https://news.ycombinator.com/item?id=10631806
- snazz 7y agoUse a crypto-quality PRNG (/dev/urandom is fine) and you should be fine, especially since the time it takes to brute-force URL parameters is very high (network latency). Just about anything is better than sequential numbers here.
- codingdave 7y agoThey are harder to guess than sequential numbers. No security is perfect - it is all deterrence. Using UUIDs instead of numbers at least closes the front door, even it it isn't locked.