I would like to move from sequential to random user-ids so I can host profile photos publicly. i.e. example.com/profilepics/asdf-1234-zxcv-7890.jpg
How long must user-ids be to keep anyone from finding any user photos for which they have not been given the link?
Does 16 lowercase letters and zero through nine provide a reasonable complexity? I'm basing this on 36^16 = 8x10^24, conservatively estimate 10 billion user accounts reduces the space to 8x10^14. At 1000 guesses/second it would take 25k years to find an account. Unless I'm overlooking something.