UUIDs are a valid security tool

#1

Post by stevecalifornia » Tue, Oct 03, 2023, 9:47 PM UTC

UUIDs are a valid security tool
arring.net

Re: UUIDs are a valid security tool

#2

Post by fargle » Wed, Oct 04, 2023, 2:45 AM UTC

what?!?!

why would you use a UUID for this? A version 4 UUID does have about 122 random bits, so it could work OK for this use case. But firstly, it's unnecessarily short. And secondly, why? FFS, WHY?

Why not just use a random number with the length of your choosing, encoded in hex, base-64, or whatever floats your boat?

Re: UUIDs are a valid security tool

#3

Post by mooktakim » Wed, Oct 04, 2023, 9:11 PM UTC

fargle wrote: post #2

what?!?! why would you use a UUID for this? A version 4 UUID does have about 122 random bits, so it could work OK for this use case. But firstly, it's unnecessarily short. And secondly, why ? FFS, WHY? Why not just use a random number with the length of your choosing, encoded in hex, base-64, or whatever floats your boat?

UUID does a lot of that for you already and you know its URL friendly. Its good enough for hiding things behind a URL and being unguessable. Good enough.