3 ms·
> you can tell the growth rate of the company. You can even do this when you don’t know the exact interval by using probabilities. The Allies used this method
by pacificmint 3y ago
> you can tell the growth rate of the company.
You can even do this when you don’t know the exact interval by using probabilities. The Allies used this method to estimate German tank production in World War II by analyzing the serial numbers of captured or destroyed tanks.
This is know as the German Tank Problem [1]
[1] https://en.wikipedia.org/wiki/German_tank_problem https://en.wikipedia.org/wiki/German_tank_problem
- lhamil64 3y agoIt also makes it slightly easier to perform certain attacks since it's trivial to figure out other IDs.
- ozim 3y agoMaking non-guessable IDs for broken authorization is security by obscurity. If you have integer IDs it is also trivial to find authorization flaws on your own. Any pentester will go for it right away. If you make non guessable IDs they might skip it and go look for other stuff.
- leobg 3y agoVery interesting. I’m a lawyer and using sequential IDs in a fraud case right now, to determine the number of victims. Unfortunately, so far, I only have the IDs of two victims, and those are from just within about a month, whereas the fraud has likely been going on for several years. Just simply extrapolating that growth rate isn’t going to be very accurate. Also, I suspect that the perpetrators did not start at ID 1.
- namtab00 3y agoehm, yeah, n=2 will not get you anything useful... that'll be like trying to determine the average salary in a company with only two known ones, which could be the janitor's and the CEO's
- selcuka 3y ago> that'll be like trying to determine the average salary in a company with only two known ones, which could be the janitor's and the CEO's Ironically that would be somewhat close to the actual average.
- mcherm 3y agoIt would be significantly above the average unless the company is ridiculously top-heavy or has shockingly little variation in salary. Or if the "salary" for the CEO ignores certain compensation (eg: paid a salary of $1 + stock options).
- selcuka 3y agoSure thing. I could have worded it better, but I was trying to say that it would be much more skewed if the two samples were, say, CEO and the CFO, or two janitors.
- pixel8account 3y agoEven with n=1 you can get something useful. IIRC "on average" if you have ID x than the best population estimation is 2*x. Of course the error margin is immense, but it's still better than nothing.
- infogulch 3y agoYou might try to use the information to find more victims first.
- rkagerer 3y agoI would have introduced random, increasing skips in the sequence to make my army look 10x bigger.