3 ms·
You really care about exposing a serial number scheme for a list of books your company publishes, or the identifier for each of the various hotels you own, or t
by CPLX 4y ago
You really care about exposing a serial number scheme for a list of books your company publishes, or the identifier for each of the various hotels you own, or the cities you have an office in or something?
- michaelmior 4y agoProbably not, but you definitely should care about not issuing sequential credit card numbers. Probably not the best example, but I don't think it's hard to imagine some scenario in between the two that still presents a concern.
- seanhunter 4y agoYou can't just use sequential numbers for credit cards because they have a builtin checksum validation called "Luhn's algorithm" https://www.creditcardvalidator.org/articles/luhn-algorithm https://www.creditcardvalidator.org/articles/luhn-algorithm
- michaelmior 4y agoSure, that wasn't really my point though. My point was that there are some cases where sequential identifiers would cause security concerns and some cases where they would not.
- quesera 4y agoIt's not only about predictability. Exposing a serial number can also be competitive intelligence. Number of users, transactions, etc. Sometimes this matters.
- CPLX 4y agoYes of course. Which is why I picked a few examples where it doesn’t matter. Stuff you’d just always have a public catalog of.
- nevir 4y agoAbsolutely (once your business reaches a certain scale). It can give competitors the ability to estimate the size/success/etc of various aspects of your business. This was a major motivation for a certain online retailer to generate non-sequential IDs. Some other interesting examples in an old HN thread: https://news.ycombinator.com/item?id=7278198 https://news.ycombinator.com/item?id=7278198