News for hackers. Stuff that matters.

A comment on First American Financial Corp. Leaked Hundreds of Millions of Insurance Records. Parent comment

Re:First American Financial Corp. Leaked Hundreds of Million... by ciupicri on Friday May 24, 2019 @11:25PM (#20006929)
From https://littlemaninmyhead.wordpress.com/2015/11/22/cautionar...

> Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access), for example.

HN discussion: https://news.ycombinator.com/item?id=10631806

[ Parent | on HN ]
Re:First American Financial Corp. Leaked Hundreds of Million... by GordonS on Saturday May 25, 2019 @05:47AM (#20008035)
Sure, security is about taking a layered approach - I don't think anyone would seriously advocate using knowledge of a UUID as enough authorisation on it's own. Well, I hope not :)
[ Parent | on HN ]