2 ms·

> A UUIDv7 of a medical record tells you when some medical event occurred. It tells you when the event was documented. If the event didn't contain a date time

> A UUIDv7 of a medical record tells you when some medical event occurred. It tells you when the event was documented. If the event didn't contain a date time stamp itself, I would be highly surprised, because what other value is there in documenting it? The security problem here is inherent in the practice and your choice of primary key isn't a material factor at all. Do you imagine there's a public CRUD database with simple Rails style accessors that can drill all the way down to individual event records inside my health information? And that, somehow the leak of a primary key in a URL might give away the fact that _something_ happened to me, medically, 12 days ago?

ivan_gammel 3y ago
>And that, somehow the leak of a primary key in a URL might give away the fact that _something_ happened to me, medically, 12 days ago Just as a side note: it may also leak the location, not just the time. An that is enough e.g. for disproving an alibi or leaking an important commercial secret (if you are in the same location as competitor HQ, for example).
- akira2501 3y ago
  UUIDv1 is the only one that specifies a MAC address to be included in the UUID. All others specify timestamp data, pseudo random values, or MD5/SHA1 string hashes. I cannot rightly apprehend the scenario you are describing. A medical provider might generate a UUIDv1 and add it to a record of mine, and this will somehow destroy my ability to have an alibi in court with respect to corporate espionage? I'm not in a bond movie, I just need to keep track of events and have them sort in chronological order
  - ivan_gammel 3y ago
    I‘m just pointing out that an identifier with timestamp in certain situations can leak more than just timestamp. E.g. an identifier of medical record in the hospital which location is known. Just this. The exact scenarios of how it can be leaked and how this information can be used are left to your imagination. The possibility of such attack depends on what’s at stake.

ivan_gammel 3y ago

>And that, somehow the leak of a primary key in a URL might give away the fact that _something_ happened to me, medically, 12 days ago Just as a side note: it may also leak the location, not just the time. An that is enough e.g. for disproving an alibi or leaking an important commercial secret (if you are in the same location as competitor HQ, for example).

akira2501 3y ago
UUIDv1 is the only one that specifies a MAC address to be included in the UUID. All others specify timestamp data, pseudo random values, or MD5/SHA1 string hashes. I cannot rightly apprehend the scenario you are describing. A medical provider might generate a UUIDv1 and add it to a record of mine, and this will somehow destroy my ability to have an alibi in court with respect to corporate espionage? I'm not in a bond movie, I just need to keep track of events and have them sort in chronological order
- ivan_gammel 3y ago
  I‘m just pointing out that an identifier with timestamp in certain situations can leak more than just timestamp. E.g. an identifier of medical record in the hospital which location is known. Just this. The exact scenarios of how it can be leaked and how this information can be used are left to your imagination. The possibility of such attack depends on what’s at stake.