News for hackers. Stuff that matters.
Re:Blog post id enumeration can lead to unwanted information... by JoshTriplett on Monday February 29, 2016 @03:32AM (#11194274)
> Easiest way is simply XOR the database auto-increment ID with a fixed number, then truncate to (AND to) however many bits seem reasonable for your site.

XOR has a trivial known-plaintext attack, and you don't even need to determine the entire key to get something useful. If you can create a few posts in order and obtain a series of sequential items, you can obtain the low-order bits of the number XORed in, at which point you can easily browse around for adjacent items from any post.

Re:Blog post id enumeration can lead to unwanted information... by ars on Monday February 29, 2016 @03:52AM (#11194320)
Like I said, not secure. But still useful for certain cases.
Re:Blog post id enumeration can lead to unwanted information... by dchest on Monday February 29, 2016 @09:37AM (#11195639)
Such as? This doesn't hide IDs, as parent poster mentions. You could as well just use IDs without any transforms.