2 ms·
The issue isn't really passwords where a UUID would be totally overkill, it's for things like capabilities. For example, I could put a file at `example.com/<som
by insanitybit 4y ago
The issue isn't really passwords where a UUID would be totally overkill, it's for things like capabilities. For example, I could put a file at `example.com/<some uuid>` and no one could find it unless I told them about it. As the author points out, my chance of an attacker guessing that url isn't 2^128 but instead 2^122. For many cases that's actually fine.
- vbezhenar 4y agoIt’s 2^122. Or 2^128 if you don’t care about stupid standards (why would you). Birthday paradox is about getting collisions, not guessing.
- insanitybit 4y agoRight, yes, guessing once specific uuid wouldn't be subject to the birthday paradox, thanks. Edited my post to no longer reflect that.