News for hackers. Stuff that matters.

A comment on Flickr: Invitations disclosure (resend feature). Parent comment

Re:Flickr: Invitations disclosure (resend feature) by crucio on Sunday April 06, 2014 @04:43AM (#7540318)
Yeah it would be a fairly simple fix in code: they could hash some of the user data (e.g. email + name) and then append the id to create a token that won't ever collide and is always unique. e.g. http://www.flickr.com/invite/?resend=<hash>-<id>
[ Parent | on HN ]
Re:Flickr: Invitations disclosure (resend feature) by eli on Sunday April 06, 2014 @08:26AM (#7540731)
Sure, of course, but I would caution against playing armchair developer on someone else's product.

I'm sure product decisions I've made seem odd and inscrutable to someone else, but that's because they don't know about the backend interface to a legacy system, etc.

[ Parent | on HN ]
Re:Flickr: Invitations disclosure (resend feature) by Sovietaced on Sunday April 06, 2014 @05:10AM (#7540359)
Exactly what I was thinking, expiration isn't even necessary.
[ Parent | on HN ]
Re:Flickr: Invitations disclosure (resend feature) by kngspook on Sunday April 06, 2014 @06:16AM (#7540488)
Of course, hashing _and_ expiration would be best.

I'm not really seeing any good reason _not_ to expire them...

[ Parent | on HN ]
Re:Flickr: Invitations disclosure (resend feature) by nilved on Sunday April 06, 2014 @06:08AM (#7540473)
Or just use a UUID.
[ Parent | on HN ]
Re:Flickr: Invitations disclosure (resend feature) by logn on Sunday April 06, 2014 @07:10AM (#7540585)
UUIDs (depending on the version) could be easier to guess than a hash or random string.

See http://www.ietf.org/rfc/rfc4122.txt -->

6. Security Considerations -- Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access), for example.

[ Parent | on HN ]
Re:Flickr: Invitations disclosure (resend feature) by nknighthb on Sunday April 06, 2014 @07:51AM (#7540661)
Under no circumstances are RFC-compliant UUIDs of any version as secure as a properly-generated 128-bit (or more) key. Even version 4 and 5 UUIDs necessarily have non-random bits.

Furthermore, although the RFC makes a half-hearted attempt to nudge you in that direction, there is no assurance that any of the bits of a UUID are generated in a cryptographically secure manner. If you're using a UUID library that chooses its random numbers poorly, your results may be utterly non-random.

[ Parent | on HN ]
Re:Flickr: Invitations disclosure (resend feature) by jamiesonbecker on Sunday April 06, 2014 @11:41AM (#7541296)
Even so, UUID's would be nearly infinitely better than the current model of incrementing integers! Wow...
[ Parent | on HN ]