Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>The original issue with simple auto-incrementing values is that they are easily guessable as I noted above.

I don't think this is a real problem. If you're relying on your ID's being "unguessable" (and introducing engineering complexity to that end) for security you've already failed.



Auto-incrementing IDs also leak information. For example, if a service uses an auto-incrementing customer_id column and I'm assigned customer_id 12345, I know there are a maximum of 12344 other customers (making a few assumptions). This information is potentially useful for competitors.


what if I start at a random int number? consider your first customer to be 546472?


Sure, not a bad idea :)

That being said, I can still extract information. For example, I can create a user today, and then another user a week from today. From that information I can extract how many new users a service adds in a week.

To avoid that, I can increment by a value other than one, but that might make sharding harder unless I pick a number like 10, 1000, etc. (of course depending on sharding strategy), which is probably easy to figure out.

I guess my point is that it's harder to avoid leaking information with auto incrementing IDs. This may or may not matter depending on the use case.


You can still guess the growth over a period of time.


One such threat is enumeration. Consider the problem of sending a link to a document in an email. Often, you want this to be a shortened link because reasons (tracking, revocation, etc). If your link shortening scheme uses integers, it's easy for the document to be distributed to unintended recipients.

This is why most link shortening products use long random strings, and the ones that don't are shamed into doing so [1].

[1] https://www.wired.com/2016/04/researchers-cracked-microsoft-...


Maybe he means 'walkable'? As in with a integer (or long) based key you can just start at 0, 1, 2 etc and just query for each.

This isn't very feasible with UUIDs because something like 99.9999999% of keys won't have a corresponding object.


Simple example: we have support staff that are allowed to view any customer record but only by making a text search on their email with a precise match. We rate limit their requests as well. But we don't even want them to view one customer who doesn't need help if we can avoid it. So using UUIDs is a good way of covering this case.


If the ID is legally protected information, like HIPPA or FERPA in the US, then "guessable" is an issue.


It is real, it has been used by attackers in real life.

https://en.wikipedia.org/wiki/German_tank_problem




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: