251–260 of 381 posts
Earlier quoted context omitted.
Nerd hacker politics, but SSN leaks are no joke.
Agreed: The real joke is any organization using SSNs as an authentication mechanism (as opposed to an identifier).
Both in terms of security, and in the crime of vulnerating it.
Earlier quoted context omitted.
You should check out the author's blog post about the site — it is quite literally every UUID, computed and rendered on demand. https://eieio.games/blog/writing-down-every-uuid/
Oh.. ha, gotcha. Thanks for explaining. Incidentally, glad uuid's computed on the fly (as opposed to pre-computed) as I think the site would require a very (impossibly?) large database.
Earlier quoted context omitted.
Every uuid dot com except if greater than 2^122 -1 doesn’t have the same ring ;)
There aren't more than 2^122 UUIDv4s.
What percentage of the 100+ Zettabytes of data now on the internet does this page take up?
Earlier quoted context omitted.
It depend on the UUID version you're using. Version 4 (Random) will always have that value be 4 as per RFC 9562. So 99999999-9999-9999-9999-999999999999 is a valid UUID but not a valid UUID v4. If you wanted to be pedantic the website should have been named https://everyuuidv4.com/ https://datatracker.ietf.org/doc/html/rfc9562
The last line of https://xkcd.com/566/ , except it's UUID formats.
Earlier quoted context omitted.
All of them, more or less. There are a few marker bits but the rest are pure data. There is no error correct or redundancy.
I didn't think v4 uuid's were completely random over that 128bit space for some reason, and this was wrong, but interestingly. for a uuid like 414c1bde-b676-4242-be35-887f01a24f10, if I take its suffix 887f01a24f10 (12 chars, 48 bits) there are still 19 chars (76 bits) to the left of it. (barring the constant 13th char identifier 4) There still are 2^76 uuid's with that suffix to search through. It made sense with ip…
But overall you have that right. Every bit is either completely random or fixed. There are no reduced-randomness patterns unless you generated it wrong.
I think that's definitely possible. Especially if you realise that you only need a random-ish looking order, not a cryptographically secure random order.
Can someone ELI5? How's he ensuring uniqueness of a UUID when they are randomly generated?
They are not, 100% strictly speaking, “ensured”. But they are 128bit numbers, so you have realistically no chance of generating a uuid that someone else has already. Age-of-the-universe type chances of duplicating one.
Earlier quoted context omitted.
It’s an interesting question whether that could be fixed. I think the answer is Yes. If the author didn’t do any scrambling, and just displayed UUIDs in numeric order, then it’s trivial to enumerate search results in order. Likewise, if you do something like adding a constant mod 16 to each hex digit, you could do the same thing when you generate UUIDs matching a substring. So the question becomes whether you could f…
FWIW I am super interested in this question but feel like I don't know how to derive a satisfying answer, maybe because the one of my goals here (add "enough" entropy) is a real fuzzy "I know it when I see it" sort of thing. But I'm gonna try to get a few more crypto-knowledgeable friends to chat with me about this and write up what I learn!
I think you can get pretty far, if you compromise on your entropy: it only has to look random, not actually be random. (I mean it doesn't have to be cryptographically secure randomness.)