Re:UUIDs in MySQL are really not random
by hn_throwaway_99 on Tuesday February 05, 2019 @09:48AM
(#19085683)
But the main problem is that he thinks UUIDs are supposed to be random when they're not - their only guarantee is uniqueness. MySQL uses (IIRC) V1 UUIDs, which combine a MAC address with time, while only V4 UUIDs are random.
The MAC address is a worse problem, honestly, than that they're not random. That means your database is leaking information about which host generated the UUID, which would be useful to someone trying to exploit a particular host.
Or if you have an application installed on personal machines, it's leaking identifying information about those machines.
Re:UUIDs in MySQL are really not random
by hn_throwaway_99 on Tuesday February 05, 2019 @10:14AM
(#19085958)
This is true. I wish I could find the article but years ago I remember malicious hackers that were identified by law enforcement because their virus included some windows guids, which at the time included the Mac address.
Re:UUIDs in MySQL are really not random
by sgerenser on Tuesday February 05, 2019 @10:48AM
(#19086348)
Probably thinking about the Melissa Virus: http://archive.arstechnica.com/wankerdesk/2q99/melissa-1.htm...
Re:UUIDs in MySQL are really not random
by the_mitsuhiko on Tuesday February 05, 2019 @10:01AM
(#19085821)
Because 3 and 5 are based on hashes they will be random as well unless you know what the input value was.
I agree with the author, the lesson really is to take the documentation seriously. I think a lot of people might not be in the habit of doing that, because they find the documentation of many projects lacking, or because it’s easier just to read some walkthrough where the work is already done and they can just copy paste the commands. It’s important to fully understand what you are doing in all cases, not just ones touching cryptography.
No, the lesson here is to not assume a "random" function is cryptographically secure unless stated otherwise. The same article could be made about Math.random or rand.