3 ms·
A single pseudorandom byte chosen at container initialisation would work here, because url hashes are ephemeral. Persistent structures on the other hand are alr
by obtu 15y ago
A single pseudorandom byte chosen at container initialisation would work here, because url hashes are ephemeral. Persistent structures on the other hand are already DOS-prone, but need attacks more tailored to the application.
- mikeash 15y agoEven with a random per-initialization byte, you could still brute force it. Pick a random byte on your side, generate colliding keys with it, and send the request. If it doesn't work, just try again until it does. You'd expect to only have to try this ~256 times before succeeding, still seems pretty practical. Of course, bump this up to 2-4 bytes and it no longer is.
- oconnore 15y ago256 attempts is the upper bound. The expected value of attempts should be 128.