Hacker News Reader

Strange claim about what the site 'implies'.

I use hashids and did not assume such things.

I use it so a jerk end-user can't keep incrementing an integer-based URL param.

You rely on hashids to be secure, so that your jerk end-users can't increment the id. You would like to know how secure it actually is, don't you?

This is exactly what I'm wondering. If an attacker finds a way to reverse the hashids, then he can increment the ID and scan the resources.

No.

If they can figure that out, I will have bigger problems with the users.

So apparently you have bigger problems with the users now.

yeah seriously. the hashids people are very clear about what a terrible idea it is to think that hashids are secure in any way. fine, do a cryptographic analysis, but don’t suggest you’re actually saving people from some false claim or implication about security.

The hashids website has been updated since the cryptanalysis was published. For example, the old website used the words encrypt/decrypt instead of encode/decode, which was confusing.

Reply on news.ycombinator.com