points by gpestll 7 years ago Hi, there's a major problem with the URLS of CV's, all are available to everyone as they're numbered in order and there's no permission locks.
soccer3056 7 years ago Thanks for letting me know Have taken the site down until this is fixed Findeton 7 years ago Just use UUIDs jjjbokma 7 years ago > Do not assume that UUIDs are hard to guess; they should not be used as security capabilitieshttps://news.ycombinator.com/item?id=10631806 snazz 7 years ago Use a crypto-quality PRNG (/dev/urandom is fine) and you should be fine, especially since the time it takes to brute-force URL parameters is very high (network latency). Just about anything is better than sequential numbers here. codingdave 7 years ago They are harder to guess than sequential numbers.No security is perfect - it is all deterrence. Using UUIDs instead of numbers at least closes the front door, even it it isn't locked. Xelbair 7 years ago Guids instead of numbers should suffice as quick and dirty fix :)
Findeton 7 years ago Just use UUIDs jjjbokma 7 years ago > Do not assume that UUIDs are hard to guess; they should not be used as security capabilitieshttps://news.ycombinator.com/item?id=10631806 snazz 7 years ago Use a crypto-quality PRNG (/dev/urandom is fine) and you should be fine, especially since the time it takes to brute-force URL parameters is very high (network latency). Just about anything is better than sequential numbers here. codingdave 7 years ago They are harder to guess than sequential numbers.No security is perfect - it is all deterrence. Using UUIDs instead of numbers at least closes the front door, even it it isn't locked.
jjjbokma 7 years ago > Do not assume that UUIDs are hard to guess; they should not be used as security capabilitieshttps://news.ycombinator.com/item?id=10631806 snazz 7 years ago Use a crypto-quality PRNG (/dev/urandom is fine) and you should be fine, especially since the time it takes to brute-force URL parameters is very high (network latency). Just about anything is better than sequential numbers here. codingdave 7 years ago They are harder to guess than sequential numbers.No security is perfect - it is all deterrence. Using UUIDs instead of numbers at least closes the front door, even it it isn't locked.
snazz 7 years ago Use a crypto-quality PRNG (/dev/urandom is fine) and you should be fine, especially since the time it takes to brute-force URL parameters is very high (network latency). Just about anything is better than sequential numbers here.
codingdave 7 years ago They are harder to guess than sequential numbers.No security is perfect - it is all deterrence. Using UUIDs instead of numbers at least closes the front door, even it it isn't locked.
Thanks for letting me know Have taken the site down until this is fixed
Just use UUIDs
> Do not assume that UUIDs are hard to guess; they should not be used as security capabilities
https://news.ycombinator.com/item?id=10631806
Use a crypto-quality PRNG (/dev/urandom is fine) and you should be fine, especially since the time it takes to brute-force URL parameters is very high (network latency). Just about anything is better than sequential numbers here.
They are harder to guess than sequential numbers.
No security is perfect - it is all deterrence. Using UUIDs instead of numbers at least closes the front door, even it it isn't locked.
Guids instead of numbers should suffice as quick and dirty fix :)