First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

Re:First American Financial Corp. Leaked Hundreds of Million... by sverhagen on Friday May 24, 2019 @09:23PM (#20006575)

On average: yes. Always: no.

[ Parent | on HN ]

Re:First American Financial Corp. Leaked Hundreds of Million... by tptacek on Friday May 24, 2019 @10:05PM (#20006678)

Always no? What's a situation in which you'd be better off with monotonic ids?

[ Parent | on HN ]

Re:First American Financial Corp. Leaked Hundreds of Million... by sverhagen on Saturday May 25, 2019 @03:37AM (#20007621)

I never said they were less secure. I said there are situations where they're not really more secure.

If I can see in this HTML page that your reply is /reply?id=12345, then it doesn't matter if Hacker News uses integers or UUIDs, if there's a bug in /edit?id=12345 that just lets me edit it without the appropriate security. If we say that UUIDs always make everything inherently more secure, we're doing everyone a disservice.

Now, the original discussion was about (1) discovering for read, and not about (2) escalating a read to a write. But if anyone reading this mistakenly takes from it that UUIDs are the way to solve these problems then they will go on optimizing for (1) at the expense of (2).

[ Parent | on HN ]