Blog post id enumeration can lead to unwanted information disclosure

Re:Blog post id enumeration can lead to unwanted information... by dchest on Monday February 29, 2016 @05:00AM (#11194540)

Just generate a random string (make sure to use the proper generator, e.g. https://gist.github.com/dchest/751fd00ee417c947c252). If the result is shorter than, say 100 bits, you'll have to check for collisions (e.g. unique constraint in database).

Alternatively, if you have 64-bit sequences as IDs (e.g. autoincremented ids in SQL database), you can encrypt then using a real 64-bit block cipher, such as Blowfish or XTEA, with a secret key known only to server. This can give you unsigned 64-bit numbers, which are usable in existing systems (except in JavaScript, where maximum integer has 53 bits), for example:

   1 -> 3491820675944448233
   2 -> 9264994595240464886

If you use base64 encoding, it will give you 11-character strings, e.g. "0AdUgU8OZfo". Make sure to use URL-safe encoding, though (instead of +, / it uses -, _).

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by infogulch on Monday February 29, 2016 @03:36PM (#11198255)

Or even better: base58 encoded[0].

>Compared to Base64, the following similar-looking letters are omitted: 0 (zero), O (capital o), I (capital i) and l (lower case L) as well as the non-alphanumeric characters + (plus) and / (slash).

[0]: https://en.wikipedia.org/wiki/Base58

[ Parent | on HN ]