Flickr: Invitations disclosure (resend feature)

Re:Flickr: Invitations disclosure (resend feature) by logn on Sunday April 06, 2014 @07:10AM (#7540585)

UUIDs (depending on the version) could be easier to guess than a hash or random string.

See http://www.ietf.org/rfc/rfc4122.txt -->

6. Security Considerations -- Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access), for example.

[ Parent | on HN ]

Re:Flickr: Invitations disclosure (resend feature) by nknighthb on Sunday April 06, 2014 @07:51AM (#7540661)

Under no circumstances are RFC-compliant UUIDs of any version as secure as a properly-generated 128-bit (or more) key. Even version 4 and 5 UUIDs necessarily have non-random bits.

Furthermore, although the RFC makes a half-hearted attempt to nudge you in that direction, there is no assurance that any of the bits of a UUID are generated in a cryptographically secure manner. If you're using a UUID library that chooses its random numbers poorly, your results may be utterly non-random.

[ Parent | on HN ]

Re:Flickr: Invitations disclosure (resend feature) by jamiesonbecker on Sunday April 06, 2014 @11:41AM (#7541296)

Even so, UUID's would be nearly infinitely better than the current model of incrementing integers! Wow...

[ Parent | on HN ]