News for hackers. Stuff that matters.

A comment on “Older unlisted videos will be made private unless you opt out”. Parent comment

Re:“Older unlisted videos will be made private unless you op... by quantumofalpha on Wednesday June 23, 2021 @06:36PM (#27611436)
Yes, exactly. Video ID is just a base64'ed DES-encrypted primary int64 video key from MySQL. It used to be sequentially incremented until at some point they switched to randomly generated primary keys. Any (ex-) engineer who snapped a copy of the encryption key (it used to sit right in the code for anyone to see) can enumerate all videos from YT until that moment, including unlisted - which are only protected by secrecy of that one key. If the key leaks, then also anyone in the world can. That's what they are afraid of here. Source: worked for YT.
[ Parent | on HN ]
Re:“Older unlisted videos will be made private unless you op... by ktm8 on Wednesday June 23, 2021 @06:42PM (#27611494)
Just for curiosity, how would YT deal with ID collision ?

Edit: Before the scheme change I mean

[ Parent | on HN ]
Re:“Older unlisted videos will be made private unless you op... by Thorrez on Thursday June 24, 2021 @12:30AM (#27614010)
>base64'ed DES-encrypted primary int64

Block ciphers (such as DES) don't collide. If they did there would be no way to decrypt them because a block could be decrypted into multiple valid plaintexts.

[ Parent | on HN ]
Re:“Older unlisted videos will be made private unless you op... by quantumofalpha on Wednesday June 23, 2021 @07:12PM (#27611752)
Not sure about technical details for that but perhaps something like https://vitess.io/docs/reference/features/vitess-sequences/. Vitess itself is a project that grew out of YouTube's needs to scale and shard their MySQL DB.
[ Parent | on HN ]
Re:“Older unlisted videos will be made private unless you op... by remram on Wednesday June 23, 2021 @06:51PM (#27611565)
Probably they just roll again. You can even implement that in a stored procedure.
[ Parent | on HN ]
Re:“Older unlisted videos will be made private unless you op... by root_axis on Wednesday June 23, 2021 @06:47PM (#27611530)
Try again? Just a guess.
[ Parent | on HN ]