Blog post id enumeration can lead to unwanted information disclosure

Re:Blog post id enumeration can lead to unwanted information... by kjksf on Monday February 29, 2016 @01:25AM (#11193911)

You can use http://hashids.org/. It obfuscated the real ids with reversible (but secret and un-guessable) transformation so on the server I deal with numeric ids (like 5) but the browser sees something like vgRg. I wrote up a bit more about this: https://quicknotes.io/n/vgRg-how-to-prevent-competitors-from...

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by dchest on Monday February 29, 2016 @04:56AM (#11194531)

The are not secret and not unguessable, they use some homegrown cipher, calling the result of encryption a "hash" for some reason (http://carnage.github.io/2015/08/cryptanalysis-of-hashids/)

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by yetanothercoder on Monday February 29, 2016 @09:31AM (#11195613)

It's for search/seo reasons.

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by michaelt on Monday February 29, 2016 @11:59AM (#11196563)

I see in your note you say there are many implementations of this idea

Is there a general name for this pattern? I'd like to find some of the other libraries for doing the same thing.

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by imron on Monday February 29, 2016 @01:32AM (#11193922)

The link you provided to the write up is not a valid link.

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by kjksf on Monday February 29, 2016 @03:23AM (#11194245)

Sorry about that, it was a private note. Fixed now.

[ Parent | on HN ]