Re:Hidden in plain sight: Brute-forcing Slack private files
by MichaelGG on Friday November 06, 2015 @02:02PM
(#10521268)
Basically the whole "version" UUIDs is a stupid fever dream. Any sane implementation should return 16 random bytes and be done. The fact that there's a spec for this and it's longer than 2 sentences is just wrong.
[ Parent
| on HN ]
Re:Hidden in plain sight: Brute-forcing Slack private files
by mikeash on Friday November 06, 2015 @02:09PM
(#10521307)
I think they were just afraid of the birthday paradox. But I agree, just grabbing some random bytes really is the way to go.
Although, I'm a bit afraid of the birthday paradox, maybe we should use 20 bytes instead....
Re:Hidden in plain sight: Brute-forcing Slack private files
by MichaelGG on Friday November 06, 2015 @02:34PM
(#10521477)
The idea that a UUID should have a "version" and the random one uses 122 bits instead of 128 bits sorta makes ya wonder how concerned they were.
Re:Hidden in plain sight: Brute-forcing Slack private files
by jasonwatkinspdx on Friday November 06, 2015 @03:01PM
(#10521651)
Yeah, spot on. At least now in 2015 using 16 bytes for id's and hashes no longer seems like a lot of memory or storage.
It pains me to see people inventing weird id schemes for every app and api.