3

I have an application which uses UUID as an authentication. The UUID is stored as KeyChain inside my iOS application. When I post the UUID, I use https. Is there any way to obtain the password, unless you have physical or remote access to the device? Is this approach strongly discouraged?

This question addresses the use the UUID as input in a text field, while my question is to use UUID as authentication after a login complete state. If you type it in a text field, the user has to know the UUID. (Talking about my application) First of all, the user does not know his/hers UUID. Second of all, the UUID is encrypted inside KeyChain.

Improve this question
10
  • No. UUID generation is designed with conflict avoidance first and foremost, but they are somewhat predictable, having a consistent device and time-based components.
    – nbering
    Commented Jul 28, 2018 at 0:04
  • So I should not use this approach, but real authentication instead?
    – Test tester
    Commented Jul 28, 2018 at 0:05
  • The UUID is made in PHP, how is it predictable?
    – Test tester
    Commented Jul 28, 2018 at 0:07
  • It depends what you are trying to protect and what the user experience you’re looking for is. If you are only trying to identify the device and not the user, a secure random string generated by the server and stored on the device during first use would probably be better than a UUID.
    – nbering
    Commented Jul 28, 2018 at 0:08
  • 1
    UUIDs are intended to solve the problem of conflicting identifiers in distributed systems, not provide secure randomness for encryption or authentication.
    – nbering
    Commented Jul 28, 2018 at 0:14

1 Answer 1

Reset to default
7

No, you should not use UUIDs as authentication tokens.

UUIDs are designed to be unique, not to be random or unpredictable. See wikipedia for a list of methods used to generate UUIDs. Let's take, for example,

Version 1 (date-time and MAC address)

Version 1 concatenates the 48-bit MAC address of the "node" (that is, the computer generating the UUID), with a 60-bit timestamp, being the number of 100-nanosecond intervals since midnight 15 October 1582.

If I was an attacker trying to predict the next UUID your server will generate, well once I've seen one one of your UUIDs then I know your MAC address, then I sync my system clock close to yours and I have a high chance of predicting your UUIDs. Your UUIDs are giving you ... maybe the equivalent of a 3 digit PIN's worth of security.

Now, you're proposing to use this as a super secret value that only the server and the logged in user know...

I could make some specific suggestions to improve your scheme, but you could probably benefit from doing some broad ground-up reading about "web authentication" and "session management". Here's a good primer to get you started:

https://www.owasp.org/index.php/Session_Management_Cheat_Sheet

Improve this answer
2
  • 2
    Good answer. I note that type 4 guids are random but not guaranteed to be crypto strength so again, an attacker who knows one type 4 guid can enumerate the space of likely subsequent or previous guids generated.
    – Eric Lippert
    Commented Jul 28, 2018 at 15:37
  • If I am not mistaken, UUIDs generated using a cryptographically strong pseudo random number generator can be used as authentication tokens (see the link to the question this is marked a duplicate of).
    – Behrang Saeedzadeh
    Commented Jun 6, 2019 at 6:06

Not the answer you're looking for? Browse other questions tagged .