Re:Exposing sequential IDs is bad Here is how to avoid it
by ConnorLeet on Tuesday February 09, 2021 @11:09PM
(#26085658)
Possessing an ID, shouldn’t give access, regardless of whether it’s a numerical PK or a UUID. (Unless that’s a feature, like shareable links) Still need to check if the user should be able to use that ID.
If that isn’t implemented, the system isn’t secure, doesn’t matter which path you use.
Re:Exposing sequential IDs is bad Here is how to avoid it
by dredmorbius on Wednesday February 10, 2021 @03:20PM
(#26094176)
If the ID scheme mapping is sufficiently dense, traversal attacks on otherwise obscured namespaces become an option.
This might apply to user accounts, posts, payment accounts, or other elements.
Security isn't simply about compromising account credentials or access policies. It may be any unintended or unexpected data disclosure, inferred relationships (between accounts, activity, finances, offline attributes, access, reputation, and more), denial of access, stalking or harassment, and more.
These might not be unexpected in all cases, but could well be undesired in many instances.
- Not all systems make user data (or all user data) visible. UUIDs make guessing or traversing the address space harder.
- Certain types of attacks are easier given known, guessable, predictable, or sequential identifiers. UUIDs mitigate these attacks.
- Certain types of system confidentiality are generally easier to maintain with UUIDs. (Unless, of course, you then hand over the full listing, as Google did with G+.)
- Where merging systems, UUIDs may (or may not) help avoid namespace collisions. (Merging disparate systems with independent UID conventions is a notoriously fraught problem.)
On sites helping search engines: so far as I've been able to suss out, Facebook actually leans strongly the other way. I don't seem to get much insight to Facebook by trying to do site:facebook.com limited searches (through DDG, which is to say, Bing, or Google). FB's view seems to be that if you want to see or search content on the site, you create an account and go there through the account to find content. I don't often find myself interested in searching FB myself, but for as large a site as it is, it seems to turn up in results remarkably less often than other notably closed/annoying domains, say, Scribd or Pinterest.
Even as of 2015, FB's representation among various traditional and social-media options for a set of arbitrary interest queries was relatively modest (though higher than I'd recalled before going back to look at my results) and I believe (based on impressions rather than focused research) it's become more search-engine opaque since:
https://old.reddit.com/r/dredmorbius/comments/3hp41w/trackin...