3 ms·

I’ve seen guids used as secrets on APIs/cookies. Those are easily guessable and also not random.

• hombre_fatal 6y ago
  Not sure what you have in mind when you say guids, but the word guid doesn't confer any info here. Most people are referring to uuids when they say guid, and a v4 uuid has 122 bits of randomness. A random 122 bit number can certainly be sufficient for most applications like api keys over the network.
  • matthewdgreen 6y ago
    Some standard uuid libraries have weird not-very-random fallbacks when the RNG fails to initialize. It’s rare, but you can get strange stuff without realizing it. Better to use a real RNG and check error codes.
    • hombre_fatal 6y ago
      Yep, there's no rule of thumb that can spare you from reading the docs and knowing basic things about the code you're about to pull in.
  • adrr 6y ago
    Guids is uuid and they can be interchanged but they all have same concept of creating unique identifiers that won’t ever collide. It isn’t random is the problem and they are are used everywhere as a secret. People think they are random 122bit value.
    • Dylan16807 6y ago
      No, that's why you need to be specific. v4 is random, other versions aren't.
      • adrr 6y ago
        You’re right I’d just looked at the rail implementation. I was basing it on my past knowledge of windows GUID implementation.