Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sqids – Generate short unique IDs from numbers

sqids.org

Post reply on HN
Print view View original

191–200 of 249 posts

Re: Sqids – Generate short unique IDs from numbers

#191

Post by notfed »

I appreciate that the author clearly states that security, i.e., output can't be reversed back to the input, is a non-requirement. We can't criticize the author too much for that either, because, as a rule, "random-looking id generator" algorithms will always be either not secure, or not short, or not collision-free. Or they'll be a key-value database.

A secure "random-looking id generator" is called a block cipher. Block ciphers with less than 128 bits of output are widely considered insecure: this corresponds to about 22 base64 characters.

Going further, you probably do want to use a secure algorithm. History is full of people thinking "we don't need this to be secure, it's not used for security-sensitive things" and later regretting it. Some case studies at [1].

[1] https://www.schneier.com/blog/archives/2016/04/security_risk... .

Re: Sqids – Generate short unique IDs from numbers

#192

Post by 8organicbits »

wtetzner wrote: post #128
8organicbits wrote: post #71

Earlier quoted context omitted.

The problem is their block list will change over time. If you don't override it, then your IDs won't decode right when you update. This is a huge risk. > You have to account for scenarios where a new word might be introduced to the default blocklist https://sqids.org/faq#future-blocklist Honestly, I think they need to rethink this. Otherwise you've got different library versions for different languages each using dif…

> If you don't override it, then your IDs won't decode right when you update. They'll decode fine. Encoding might change.

I think your right, but that violates the uniqueness guarantee. It doesnt seem like something that should change over time by default.

Re: Sqids – Generate short unique IDs from numbers

#193

Post by ozim »

lhamil64 wrote: post #88
pacificmint wrote: post #77

Earlier quoted context omitted.

> you can tell the growth rate of the company. You can even do this when you don’t know the exact interval by using probabilities. The Allies used this method to estimate German tank production in World War II by analyzing the serial numbers of captured or destroyed tanks. This is know as the German Tank Problem [1] [1] https://en.wikipedia.org/wiki/German_tank_problem

It also makes it slightly easier to perform certain attacks since it's trivial to figure out other IDs.

Making non-guessable IDs for broken authorization is security by obscurity.

If you have integer IDs it is also trivial to find authorization flaws on your own. Any pentester will go for it right away.

If you make non guessable IDs they might skip it and go look for other stuff.

Re: Sqids – Generate short unique IDs from numbers

#194

Post by geek_at »

notfed wrote: post #191

I appreciate that the author clearly states that security, i.e., output can't be reversed back to the input, is a non-requirement. We can't criticize the author too much for that either, because, as a rule, "random-looking id generator" algorithms will always be either not secure, or not short, or not collision-free. Or they'll be a key-value database. A secure "random-looking id generator" is called a block cipher.…

> i.e., output can't be reversed back to the input

But in the "Not good for" section it states the opposite: "[not good for] User IDs can be decoded, revealing user count" so it can be reversed?

Re: Sqids – Generate short unique IDs from numbers

#195

Post by s4i »

hot_gril wrote: post #186
s4i wrote: post #166

If the original numeric ID can be figured out from the sqid string, then what’s the point of the conversion?

The point is to make a long number more human-friendly. But I don't get why these are non-sequential then.

Unless we are talking about very long numbers, surely the numbers are easier for people to deal with, say over the phone, etc?

Re: Sqids – Generate short unique IDs from numbers

#196

Post by hot_gril »

s4i wrote: post #195
hot_gril wrote: post #186

Earlier quoted context omitted.

The point is to make a long number more human-friendly. But I don't get why these are non-sequential then.

Unless we are talking about very long numbers, surely the numbers are easier for people to deal with, say over the phone, etc?

I was going to say it's for very long numbers, but I tried an example, and 123645634 becomes ARsz1pHw789c7ESzhy. The output is actually longer, and more complicated.

Looks like it uses a hash. I was expecting it to just convert the base except with something to skip profanity, which would give you something much shorter going base 10 to base ~36. Tbh I don't see why it's like this.

Re: Sqids – Generate short unique IDs from numbers

#197

Post by residentcoder »

geek_at wrote: post #194
notfed wrote: post #191

I appreciate that the author clearly states that security, i.e., output can't be reversed back to the input, is a non-requirement. We can't criticize the author too much for that either, because, as a rule, "random-looking id generator" algorithms will always be either not secure, or not short, or not collision-free. Or they'll be a key-value database. A secure "random-looking id generator" is called a block cipher.…

> i.e., output can't be reversed back to the input But in the "Not good for" section it states the opposite: "[not good for] User IDs can be decoded, revealing user count" so it can be reversed?

Added parenthesis to make what your parent commentor is saying clearer:

>I appreciate that the author clearly states that security, (i.e., output can't be reversed back to the input), is a non-requirement.

Re: Sqids – Generate short unique IDs from numbers

#198

Post by timwis »

orf wrote: post #96

How do you adjust or evolve the blocklist with this, without making previously generated IDs incorrect? The ID is simply incremented if it is blacklisted [1]. So the ID is fixed to the blacklist content, and adjusting it in any way invalidates certain segments of previously generated IDs? 1. https://github.com/sqids/sqids-rust/blob/9f987886bc06875d782...

Include a version prefix perhaps?

Re: Sqids – Generate short unique IDs from numbers

#200

Post by pixel8account »

notfed wrote: post #191

I appreciate that the author clearly states that security, i.e., output can't be reversed back to the input, is a non-requirement. We can't criticize the author too much for that either, because, as a rule, "random-looking id generator" algorithms will always be either not secure, or not short, or not collision-free. Or they'll be a key-value database. A secure "random-looking id generator" is called a block cipher.…

It's good to consider this but... Plenty of sites expose user ID as a regular integer. In some cases you might want to avoid this (leaking user count to competitors etc), but I have never heard about anyone calling this a vulnerability.
Post reply on HN