> Just because I know an identifier doesn't mean I should be able to do _anything_ with it. Depends. If it’s a sequential ID, then sure, but if it’s sufficient

> Just because I know an identifier doesn't mean I should be able to do _anything_ with it. Depends. If it’s a sequential ID, then sure, but if it’s sufficiently random and sparse, then it can be fine to use it as authentication. But it’s not always about authentication and security. The information leak itself is regularly a problem. See https://en.wikipedia.org/wiki/German_tank_problem https://en.wikipedia.org/wiki/German_tank_problem for one practical example, though you normally don’t even need anything that fancy. Businesses do this where they can to analyse competitors, figure out how big they are, how they should price things, &c.