News for hackers. Stuff that matters.

A comment on Auto increment is a terrible idea.

Re:Auto increment is a terrible idea by danielovichdk on Thursday November 30, 2017 @09:37AM (#15815965)
"Use UUIDs as primary keys. They can be freely exposed without disclosing sensitive information, they are not predictable and they are performant."

When have a primary key ever been sensitive infomation ? And why would they be predictable ?

[ Parent | on HN ]
Re:Auto increment is a terrible idea by krapp on Thursday November 30, 2017 @09:45AM (#15816034)
If you use auto-incrementing IDs as both primary keys and account identifiers, which a lot of web applications do, it might be possible to identify admin and employee accounts because they're more likely to have the lower IDs. A recent Steam hack relied on this to allow bypassing the approval process for Greenlight[0].

[0]https://medium.com/swlh/watch-paint-dry-how-i-got-a-game-on-...

[ Parent | on HN ]