Blog post id enumeration can lead to unwanted information disclosure

Re:Blog post id enumeration can lead to unwanted information... by ars on Monday February 29, 2016 @03:10AM (#11194190)

Easiest way is simply XOR the database auto-increment ID with a fixed number, then truncate to (AND to) however many bits seem reasonable for your site.

Not super secure, but good enough for this purpose.

Unless you have a long ID people can always simply try every ID, no matter what format you use. So fancy encryption on the ID isn't all that useful.

If security is important then generate a random 64bit number and store that, rather than let the database auto-generate a number.

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by JoshTriplett on Monday February 29, 2016 @03:32AM (#11194274)

> Easiest way is simply XOR the database auto-increment ID with a fixed number, then truncate to (AND to) however many bits seem reasonable for your site.

XOR has a trivial known-plaintext attack, and you don't even need to determine the entire key to get something useful. If you can create a few posts in order and obtain a series of sequential items, you can obtain the low-order bits of the number XORed in, at which point you can easily browse around for adjacent items from any post.

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by ars on Monday February 29, 2016 @03:52AM (#11194320)

Like I said, not secure. But still useful for certain cases.

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by dchest on Monday February 29, 2016 @09:37AM (#11195639)

Such as? This doesn't hide IDs, as parent poster mentions. You could as well just use IDs without any transforms.

[ Parent | on HN ]