Sqids – Generate Short Unique IDs from Numbers

Re:Sqids – Generate Short Unique IDs from Numbers by notfed on Sunday November 26, 2023 @02:21AM (#38419833)

I appreciate that the author clearly states that security, i.e., output can't be reversed back to the input, is a non-requirement. We can't criticize the author too much for that either, because, as a rule, "random-looking id generator" algorithms will always be either not secure, or not short, or not collision-free. Or they'll be a key-value database.

A secure "random-looking id generator" is called a block cipher. Block ciphers with less than 128 bits of output are widely considered insecure: this corresponds to about 22 base64 characters.

Going further, you probably do want to use a secure algorithm. History is full of people thinking "we don't need this to be secure, it's not used for security-sensitive things" and later regretting it. Some case studies at [1].

[1] https://www.schneier.com/blog/archives/2016/04/security_risk... .

[ Parent | on HN ]

Re:Sqids – Generate Short Unique IDs from Numbers by geek_at on Sunday November 26, 2023 @03:48AM (#38420159)

> i.e., output can't be reversed back to the input

But in the "Not good for" section it states the opposite: "[not good for] User IDs can be decoded, revealing user count" so it can be reversed?

[ Parent | on HN ]

Re:Sqids – Generate Short Unique IDs from Numbers by residentcoder on Sunday November 26, 2023 @04:55AM (#38420448)

Added parenthesis to make what your parent commentor is saying clearer:

>I appreciate that the author clearly states that security, (i.e., output can't be reversed back to the input), is a non-requirement.

[ Parent | on HN ]

Re:Sqids – Generate Short Unique IDs from Numbers by pixel8account on Sunday November 26, 2023 @05:35AM (#38420611)

It's good to consider this but... Plenty of sites expose user ID as a regular integer. In some cases you might want to avoid this (leaking user count to competitors etc), but I have never heard about anyone calling this a vulnerability.

[ Parent | on HN ]

Re:Sqids – Generate Short Unique IDs from Numbers by woofcat on Sunday November 26, 2023 @08:50AM (#38421572)

I hear this all the time. Every 3PPT report I see is cranky if you have userid=2345 as you can enumerate it.

Personally I think it's stupid but this is a tempting solution.

[ Parent | on HN ]

Re:Sqids – Generate Short Unique IDs from Numbers by richbell on Sunday November 26, 2023 @10:40PM (#38427779)

It's referred to as an "Insecure Direct Object Reference" (IDOR) vulnerability. In many cases it is not actually a vulnerability, however, when an application contains sensitive information and lacks authorization or rate-limiting it can be exploited to enumerate the entire database.

https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Dire...

When I first joined $company, HR sent me a SharePoint document with a numerical ID. Incrementing or decrementing the ID allowed me to view personal information of other employees including their pay.

[ Parent | on HN ]

Re:Sqids – Generate Short Unique IDs from Numbers by notfed on Sunday November 26, 2023 @06:02PM (#38426016)

I realize now the site lists "One-Time Passwords" as a use-case. I'm a positive-vibes-only HN poster though, so will leave it as an exercise to the reader to decide whether that's going to turn out well or not.

[ Parent | on HN ]

Re:Sqids – Generate Short Unique IDs from Numbers by hot_gril on Monday November 27, 2023 @10:06PM (#38441805)

What's the issue with that, provided the input number is random?

My issue with Sqids is they're longer and more complicated than the input!

[ Parent | on HN ]