4

I asked a question on StackOverflow on how to generate the alphanumeric/base64 resource IDs that Youtube, Instragram, and others use to identify videos/pictures/etc. Discussion led to the question of why these IDs are used.

I assumed it was for two reasons:

  1. To shorten URLs from long integer IDs to shorter ones.
  2. To prevent casual URL hacking by editing the URL in a browser.

Is this true? Why are these IDs used?

Improve this question
8
  • 3
    This doesn't seem to be a security question.
    – Polynomial
    Commented Sep 26, 2012 at 15:04
  • I'm not sure where it should be asked, to be honest.
    – kevboh
    Commented Sep 26, 2012 at 15:04
  • StackOverflow seems the logical place.
    – Polynomial
    Commented Sep 26, 2012 at 15:10
  • 3
    @Polynomial I'd give you -1 if I could. Kevboh has made an assumption about security and is asking whether he's right, and why it would be used. If he's right, then someone should give an explanation behind the security. If not, they should help disavow him of the assumption. If you'd read the linked Stackoverflow question you'd see he'd asked how to implement this, which is exactly what that forum is for. This is about the security, hence it should be here.
    – ian
    Commented Sep 26, 2012 at 15:33
  • 1
    @Iain My apologies, I missed the word "hacking" in reason #2. I guess it is a security question, then.
    – Polynomial
    Commented Sep 26, 2012 at 15:53

2 Answers 2

Reset to default
6

Youtube must produce URL by which the videos can be referenced. They prefer that the URL be short. They can choose the ID in any way that they see fit, provided that it matches their constraints, in particular:

  • The ID must be unique (no two videos may share it).
  • The ID must "work well" with whatever indexing mechanism they internally use.

Deriving the ID from the video "title" would be problematic in several ways: difficult to guarantee uniqueness, the usual Unicode-related mayhem when people have the insufferable arrogance of using characters which are not in the ASCII set, and string-based indexing (whereas I can imagine that a database would be happier with a 64-bit integer as indexing key).

There is a priori no security issue here. There would be a security issue if the URL were meant to reference non-public documents, in which case the ability to "guess" valid URL would be problematic (a possible solution would then be to include a MAC in the ID). But Youtube videos are inherently public (they make no sense otherwise -- already, a number of them make no sense at all anyway).

Improve this answer
1
  • 2
    Youtube has private (whitelist access) or unlisted (URL access) videos though.
    – Sven
    Commented Apr 12, 2016 at 7:22
2

@kevboh, I don't think security is the primary concern, it's just a way for sites to keep resources straight in such a way that they are easy to differentiate. There's no security issue to fix; instagram and youtube want people to view their content, there's nothing they are trying to hide.

What security purpose would randomization serve in this case? Preventing people from guessing the date of creation of a resource when the date is already freely available to anyone that uses the content?

The main reason for randomization in this case is not to secure anything, but to ensure that people have to use the company's search tools and APIs to find the content. If you could guess contents' resource IDs you could bypass them, and because their business models are based on selling search choice information that could make them lose money.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .