I don't see the incrementing integer ID's as a "bad convention". It's a simple and intuitive solution that works for most apps. Its ok to be "guessable". You should set permissions properly regardless of how random your ID's are.