Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually natural integers starting from 1. Those IDs are not as safe as UUIDs (for example when pausing artificially the time such as in specs, two MongoIDs can be "sequential") but in a production environment where the time isn't frozen, it's doing better (how better is part of my question)
My question is : to what extent are the IDs generated by MongoDB "safe enough" for use in production (and by safe I mean confidentiality and all the security stuff)?
For example, assume some users are uploading files on the website (for instance in a conversation), and the said file are put on Amazon S3 and identified by a MongoID. How safe is it to make this file available to the public for convenient retrieval ? I understand the safest solution would be to have the backend generate a temporary secure URL, but I can't think of a reasonable scenario where a malicious person could create a hack to find these MongoIDs. The worst case scenario of an attacker that would successfully be able to download the DB is probably too "worse" to even consider this type of problem specifically.