Passing user ID as parameter without any authentication, what are the security risks?

Question

I've read that passing GUID as URL parameter isn't considered insecure because usually, an app has an authentication mechanism (checking against some session token).

However, how secure would an application be if the user's page can be accessed just by the GUID in the URL and there's no login / authentication at all? This GUID is quite long (about 16 characters) and the user base at a time would just be about 10,000. It's also a time-based access (e.g. users can only access this special user page for the duration of X hours).

Answer 1

what are the security risks?

The security risk is that there is no security at all to begin with.There is a reason why authentication exists.

Now lets assume that GUID is sufficiently long enough such that brute force is out of the question.But it still gets logged in so many places.

But the real threat is more from powerful crawlers that search engines have.A simple google search might leak the credentials of all the users.Plus without authorization or authentication how would you separate user space from one another.Its like an open website where anyone can be anyone without proving who they are.