First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

Re:First American Financial Corp. Leaked Hundreds of Million... by sverhagen on Friday May 24, 2019 @09:06PM (#20006521)

I think context matters here. If someone wants to hand out tokens, for instance via e-mail verification, I'm fine with relying on that being a UUID. When you make it harder (impossibly hard) to guess a "record number" by using UUIDs, which is what we were probably talking about, that's great too. (I already yielded that point.) But let's not lead the general population into thinking that UUIDs make everything safer (probably not what you were saying), because if something is "just an identifier" it may not be handled as safely, which is what this seems to be relying on in the context of security. Same as how user names were traditionally not handled as something secret or confidential. Sometimes UUIDs appear as just identifiers and are not handled with any secrecy, so they just can't always double as a security feature.

[ Parent | on HN ]

Re:First American Financial Corp. Leaked Hundreds of Million... by feanaro on Saturday May 25, 2019 @06:12AM (#20008126)

> Sometimes UUIDs appear as just identifiers and are not handled with any secrecy, so they just can't always double as a security feature.

I can see your point. If UUIDs are handled in such a way that they are discoverable by anyone, they are not enough to make the references secure.

I think the point tptacek and others are making is that this is an instance of the defence in depths principle, though. In scenarios where UUIDs are not simply discoverable, using UUIDs is inherently more secure than using a monotonic ID, simply because the monotonic ID can be easily guessed. Yet, they are still not enough in isolation and you should be additionally using proper access control (due to eventual leakage of particular UUIDs in emails and such).

[ Parent | on HN ]

Re:First American Financial Corp. Leaked Hundreds of Million... by tptacek on Friday May 24, 2019 @09:13PM (#20006544)

But UUIDs do, in fact, make things safer.

[ Parent | on HN ]

Re:First American Financial Corp. Leaked Hundreds of Million... by sverhagen on Friday May 24, 2019 @09:23PM (#20006575)

On average: yes. Always: no.

[ Parent | on HN ]

Re:First American Financial Corp. Leaked Hundreds of Million... by tptacek on Friday May 24, 2019 @10:05PM (#20006678)

Always no? What's a situation in which you'd be better off with monotonic ids?

[ Parent | on HN ]

Re:First American Financial Corp. Leaked Hundreds of Million... by sverhagen on Saturday May 25, 2019 @03:37AM (#20007621)

I never said they were less secure. I said there are situations where they're not really more secure.

If I can see in this HTML page that your reply is /reply?id=12345, then it doesn't matter if Hacker News uses integers or UUIDs, if there's a bug in /edit?id=12345 that just lets me edit it without the appropriate security. If we say that UUIDs always make everything inherently more secure, we're doing everyone a disservice.

Now, the original discussion was about (1) discovering for read, and not about (2) escalating a read to a write. But if anyone reading this mistakenly takes from it that UUIDs are the way to solve these problems then they will go on optimizing for (1) at the expense of (2).

[ Parent | on HN ]