Questions tagged [uuid]
Universally Unique Identifiers (UUIDs) are 128-bit numbers used to uniquely identify data. They are globally unique for practical purposes, with an almost negligible chance to being duplicate.
29
questions
0
votes
1
answer
58
views
Could the signature of a JWT/JWS be used as a globally unique identifier?
In other words, is a signature on a JWT or JWS always unique?
- 103
0
votes
1
answer
340
views
Collision probability between truncating vs subsequencing of SHA256 hash to 128 bits?
I am taking a SHA256 hash output in hexadecimal (64 hex nibbles), subsequencing it by taking every other character to make it 32 hex nibbles or 128 bits, and formatting it into a UUID string.
This isn'...
2
votes
2
answers
216
views
Can a UUID or GUID be matched back to the originating computer?
A comment to this question on Reddit said
It’s almost a given that somewhere in one or more files is a UUID or GUID generated on OP’s computer. Those can, with enough effort, be matched back to the ...
0
votes
1
answer
285
views
I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?
What are some attacks I can try against this form of authentication? How do I test if they are cryptographically secure as well?
0
votes
1
answer
766
views
UUIDs replacing inremental IDs in URLs
I am reading about implementing UUIDs in URLs instead of incremental IDs to reduce attack vectors using obfuscation. I plan to create a UUID from an incremental ID and store the UUID which would be ...
- 133
0
votes
1
answer
161
views
Creating a unique password for each device/unit of the same product
We are currently working on an IoT product & having a hard time coming up with a strategy to create a unique password for each device/unit.
I do understand that password based on a function of { ...
0
votes
0
answers
197
views
Guessing UUIDv1 hashes?
I'm digging into UUIDv1 generation and bruteforce, in order to take control of a password reset feature of a website which sends a link with a get parameter token=UUIDvX.
I'm trying to identify which ...
- 91
1
vote
1
answer
899
views
Is using sensitive information to generate a UUID v5 considered secure?
Lets say I want to generate a name-based UUID using v5 of the RFC 4122 using sensitive information as the input (for example the password to my bank account). And lets say I give the generated UUID to ...
- 113
0
votes
1
answer
276
views
Should I obscure database primary keys for the frontend even if these ids are uuidv4 Ids?
After reading through the answers of the related question (the same question but about integer primary keys), I was wondering if there is any reason to hash uuidv4 primary keys and sending the hash to ...
0
votes
1
answer
297
views
Best practices for generating and storing authorization codes and access tokens in OAuth server
I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any ...
- 389
-1
votes
1
answer
429
views
Stop UUID injection in MYSQL Database
I have a cordova app that logs users in based on their devices model+platform+uuid. For example:
Pixel 2Android39798721218.
The way this works when a user uses a new device is detailed in the ...
- 32
1
vote
1
answer
2k
views
using Uuid for security
I read that uuid does not bring any security advantages
But I can't find why It doesn't bring a little bit of extra security in the scenario below ?:
Consider that right now the session id is ...
- 13
0
votes
1
answer
243
views
Exposing UUID or BIGSERIAL Primary Keys
Exposing primary keys is bad practice. How should I expose UUID or BIGSERIAL Primary Keys to clients — hashing, encoding, encrypting? For integers there are libraries like hashids, what about UUID?
- 301
0
votes
1
answer
83
views
Understanding patch for my report
I reported a flaw to the security team and they changed the UIDs from regular integers to hash kind of a thing. Like this, XXXX-XXXX-and-so-on
I still want to try and bypass things but I don't ...
- 1
0
votes
0
answers
152
views
Is it possible to get the original UUID1 from a timestamp?
Say, for example, I generate a time based UUID with the following program.
import uuid
uuid = uuid.uuid1()
print uuid
print uuid.time
I get the following:
47702997-155d-11ea-92d3-6030d48747ec
...
- 143
4
votes
1
answer
2k
views
UUID as auth token [duplicate]
I am working on a small IOT device that basically is a status display, which includes data about my phone. That means that I have a simple web server running, which can be used to update the devices ...
- 43
5
votes
1
answer
2k
views
Are GUIDs safe for long lived access tokens?
There is a peice of software i am using at work that has several components to it, lets call them the server and agents.
the server runs an api over https that the agents use to communicate with it.
...
- 53
0
votes
1
answer
833
views
Passing user ID as parameter without any authentication, what are the security risks?
I've read that passing GUID as URL parameter isn't considered insecure because usually, an app has an authentication mechanism (checking against some session token).
However, how secure would an ...
- 101
1
vote
1
answer
2k
views
Identifying devices in mobile app using UUID
I have a mobile application, for Android and iOS (both native), that communicates with the backend through a REST API (over HTTPS).
The application allows users to sign in or use the app as a guest, ...
- 111
0
votes
1
answer
129
views
COM Classes CLSID
Would malware ever create a CLSID or would they just use them? This question is derived from studying COM objects. So an Adobe exploit would have an Adobe CLSID in it. Does malware ever create a CLSID ...
- 31
1
vote
2
answers
256
views
Purpose of using GUID for files along with underlying permissions checks
Some sites utilize a GUID for a file name when it goes in storage. For example, when you load up a receipt, instead of having the receipt named something like 1200 (an incremental number), it will ...
- 11
0
votes
2
answers
257
views
How to solve the problem of secure randomly generated GUIDs when the size of the data outgrows the GUIDs
I've been struggling with this problem for a little while... How to hide the order that records were created in, basically. You typically do this by generating a "GUID". But this GUID is arbitrarily ...
- 608
2
votes
0
answers
755
views
Using a GUID as an authentication token (and how it could be improved)
I'm implementing a Whatsapp Web-like feature for my Android application. User should be able to open an HTTPS web application that displays a QR code (a GUID generated by the server) and scan it using ...
- 121
2
votes
1
answer
670
views
Mobile application authentication using UUID
I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is:
When user signs in, device sends username and ...
- 121
0
votes
1
answer
468
views
Using the user's GUID-id as a salt for Rfc2898DeriveBytes
I use the Rfc2898DeriveBytes for creating an AES key for protecting the user's data.
For the salt value I would like to use the user's id, which is a guid.
My understanding is, that the only drawback ...
- 103
5
votes
2
answers
4k
views
How to reasonably hash a composite key into a UUID?
The Problem
In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID.
Solutions?
The obvious first suggestion ...
- 51
20
votes
4
answers
15k
views
Using V4 UUID for authentication
I'd like to use a V4 UUID / GUID for authenticating users. To be specific, the user would have to paste the UUID into a text field to gain access to their account. The UUID would be given to them at ...
- 201
0
votes
1
answer
19k
views
Why does UUID v4 have the format xxxxxxxx-xxxx-4xxx-zxxx-xxxxxxxxxxxx? [closed]
I'm very curious as to why the format is xxxxxxxx-xxxx-4xxx-zxxx-xxxxxxxxxxxx? Why is the 4 there, and why is z always either 8, 9, A, B? And also, why the different string lengths between the dashes? ...
- 11
1
vote
1
answer
657
views
With a very large number of GUIDs, can one predict the previous and subsequent GUIDs that will be generated?
I've been reading up on GUIDs. According to the Wiki:
Cryptanalysis of the WinAPI GUID generator shows that, since the sequence of V4 GUIDs is pseudo-random, given full knowledge of the internal ...
- 1,437