Hacker News Reader

UUIDs as tokens? wow.

Uuid makes a great token.

> Uuid makes a great token.

When they're actually unique, sure. If you're UUIDs are the byte representation of something that isn't random (i.e. something not from /dev/urandom) then no they'll suck as much as the source. Generally speaking, what you put in is what you get out.

They need to be unique and unguessable, which don't necessarily go together.

For example, a version 1 UUID is unique, but is fairly guessable, since it's just a MAC address, a timestamp, and a small random-initialized counter.

Looking at the reports, the UUID's are xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx, so V4 UUID's, which should be pretty hard to guess (barring bad PRNG, but that's a whole different problem)

Yeah, that gets you 122 bits of entropy (with a good RNG) so that should be fine. I mainly pointed that out just in case anyone assumes "UUID" automatically means "random UUID" and fails to check whether their particular UUID generator uses v4 or something else.

Reply on news.ycombinator.com