News for hackers. Stuff that matters.

A comment on Ask HN: What's the recommended method of adding authentication to a REST API?. Parent comment

Re:Ask HN: What's the recommended method of adding authentic... by user5994461 on Tuesday January 16, 2018 @01:47PM (#16160882)
>>> The short answer is: don't overthink it. Do the simplest thing that will work: use 16+ byte random keys read from /dev/urandom and stored in a database. The cool-kid name for this is "bearer tokens".

Please don't reinvent the wheel and use a guid.

A guid is a random number generator to avoid collisions.

[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by pvg on Tuesday January 16, 2018 @02:17PM (#16161284)
If you are getting collisions from 128 bit (and up) numbers coming out of a system CSRNG, your service is likely to be meaningfully affected by bigger problems like plate tectonics and lunar orbital decay.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by ta76567656 on Tuesday January 16, 2018 @02:10PM (#16161192)
Not all GUIDs are random, and not all random GUIDs are cryptographically random: https://en.wikipedia.org/wiki/Universally_unique_identifier#...
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by wglb on Tuesday January 16, 2018 @07:11PM (#16164206)
GUIDS are NOT random. They are unique (the 'U' in GUID).
[ Parent | on HN ]