Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

They (randomized type 4 UUID's) obfuscate as a side effect because they are much more difficult to guess due to their randomness. As the article points out though, they are not impossible to guess... but it will come down to your risk tolerance and what the UUID's are "protecting".

People like to reach for UUID's when obfuscation is needed because inventing your own duplicate-aware random string algorithm isn't what most folks want to spend their time thinking about. Plus, these days, many databases come with UUID-aware data types that make using UUID's fairly straight forward.



UUIDs are a vast improvement over integers for preventing simple attacks like +/-ing the id and seeing what happens.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: