>I wouldn't be thanking any gods, because no matter what those IDs look like, the only responsible thing in such a situation is to assume that an attacker does have access to every user account on the system. Moving from sequential IDs to something "hard" like UUIDs only delays the inevitable*
Well, there's nothing "inevitable". It's a computer system, not the fullfilment of some prophecy.
You can have an attack vector giving you access to a layer, without guaranteed magic access to other layers.
But even if it "just delays the inevitable", that's a very good thing, as it can be time used to patch the issue.
Not to mention, any kind of cryptography just "delays the inevitable" too. With enough time it can be broken with brute force - might not even take millions of years, as we could get better at quantum computing in the next 50 or 100.
> But even if it "just delays the inevitable", that's a very good thing, as it can be time used to patch the issue.
My point is that in this case, the additional time is nowhere near sufficient to make much of a difference. This is especially true when you consider that an attacker could be probing URLs before finding an exploit, in which case that tiny delay between "exploit found" -> "all users compromised" shrinks to zero.
Well, there's nothing "inevitable". It's a computer system, not the fullfilment of some prophecy.
You can have an attack vector giving you access to a layer, without guaranteed magic access to other layers.
But even if it "just delays the inevitable", that's a very good thing, as it can be time used to patch the issue.
Not to mention, any kind of cryptography just "delays the inevitable" too. With enough time it can be broken with brute force - might not even take millions of years, as we could get better at quantum computing in the next 50 or 100.