I would like to move from sequential to random user IDs, so I can host profile photos publicly, i.e.
How long must user IDs be to keep anyone from finding any user photos for which they have not been given the link?
Does 16 lowercase letters and zero through nine provide a reasonable complexity? I'm basing this on 3616 = 8x1024, conservatively estimate 10 billion user accounts reduces the space to 8x1014. At 1000 guesses/second, it would take 25 000 years to find an account. Unless I'm overlooking something.