4 ms·
Are sequential id’s a security risk? In one of our systems we’ve seen customer guess at other accounts by just incrementing the sequence. The rule of thumb I
by victor106 4y ago
Are sequential id’s a security risk?
In one of our systems we’ve seen customer guess at other accounts by just incrementing the sequence.
The rule of thumb I used to use is if an Id is going to be used for lookups or being exposed externally use uuid otherwise us sequential.
The hard thing about the above rule is that it’s hard to tell when you are designing the db if the id will be used externally/for lookups or not. Requirements change later.
- hnarn 4y ago"Protecting" records by making IDs hard-to-guess just seems like putting the responsibility in the wrong place. If you're so worried about people getting their hands on the wrong records, I'd be more worried about your lack of trust in the application that queries that database in the first place: remember, even if you do make the IDs hard to guess, your "untrusted application" might at some point decide to simply leak the entire table instead. There are much better solutions for this, like server-side prepared queries that do not simply return on an ID but rather as the result of a join, or just proper security practices in general, rather than reactively making something that was once guessed simply harder to guess. Also, something like an ID is in my experience something that will be referred to orally between two human beings when discussing a problem, like referring to user 6201 or discussing invoice 540567. When you switch to UUIDs you're basically also saying "no human will ever have to say this out loud".
- insanitybit 4y ago> "Protecting" records by making IDs hard-to-guess just seems like putting the responsibility in the wrong place. It's a pretty powerful implementation of capability based security.
- yellowapple 4y agoI would hope that a capability-based security system entails considerably more than just knowledge of an ID.
- yencabulator 4y agoMany actual capability systems explicitly construct their capabilities to be unforgeable by not making them be mere secret byte strings, but objects protected by the kernel or other environment. For example, https://www.cs.cornell.edu/courses/cs513/2000SP/L08.html https://www.cs.cornell.edu/courses/cs513/2000SP/L08.html And then people naively copy operating system design methodology into web APIs... Unrevokable leakable know-it-and-you're-in secrets are a bad idea.
- oslac 4y agoUUID does not protect your records, that is, it is not a security measure against what you describe.
- insanitybit 4y agoIt is if you don't expose a 'list' api, only a 'get'.
- adamckay 4y agoUUID is a part of the protection. If your access controls fail then preventing an attacker from enumerating through data by incrementing an integer is protection from Insecure Direct Object Reference. [1] Even if there are no vulnerabilities in access controls it can also prevent competitors from knowing how busy your platform is. If I register a new account on your system and I get ID 57854 and a week later I register another and get ID 57978 then I know 124 new users have signed up in that time. 1 - https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Dire...
- victor106 4y agoThank you so much for this.
- ASalazarMX 4y ago> In one of our systems we’ve seen customer guess at other accounts by just incrementing the sequence. What can they do with that guess? A sensible access control would not even let them see if the account is active, cancelled, or invalid.