Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Do not assume that UUIDs are hard to guess; they should not be used as security capabilities

https://news.ycombinator.com/item?id=10631806



Use a crypto-quality PRNG (/dev/urandom is fine) and you should be fine, especially since the time it takes to brute-force URL parameters is very high (network latency). Just about anything is better than sequential numbers here.


They are harder to guess than sequential numbers.

No security is perfect - it is all deterrence. Using UUIDs instead of numbers at least closes the front door, even it it isn't locked.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: