Unique Ids Should Be Secure. Most Ids Aren't

Neat. I use capability URLs quite often to convey secret information without the user needing an account for authentication. Yes, URLs aren't meant to be kept secret, so the resources are only accessible a limited amount of time.

Also very useful for the usual password reset link.

Auth has changed a lot recently and honestly I think a lot of it is crap and leads to far more complex security problems. Not everything of course. There is also a problem that many developers don't know about the intrinsics here.

A good random id generator can be very helpful and provide easy and real security.