Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [uuid]

Universally Unique Identifiers (UUIDs) are 128-bit numbers used to uniquely identify data. They are globally unique for practical purposes, with an almost negligible chance to being duplicate.

Filter by
Sorted by
Tagged with
0 votes
1 answer
33 views

I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?

What are some attacks I can try against this form of authentication? How do I test if they are cryptographically secure as well?
user avatar
0 votes
1 answer
143 views

UUIDs replacing inremental IDs in URLs

I am reading about implementing UUIDs in URLs instead of incremental IDs to reduce attack vectors using obfuscation. I plan to create a UUID from an incremental ID and store the UUID which would be ...
user avatar
  • 133
0 votes
0 answers
158 views

Is UUID enough to secure public links? [duplicate]

I send email invitations to people and each invitee gets a unique link where they can click on a button to leave a response. The data is not very secret, the worst thing that can happen is that ...
user avatar
  • 101
0 votes
1 answer
128 views

Creating a unique password for each device/unit of the same product

We are currently working on an IoT product & having a hard time coming up with a strategy to create a unique password for each device/unit. I do understand that password based on a function of { ...
user avatar
0 votes
0 answers
114 views

Guessing UUIDv1 hashes?

I'm digging into UUIDv1 generation and bruteforce, in order to take control of a password reset feature of a website which sends a link with a get parameter token=UUIDvX. I'm trying to identify which ...
user avatar
  • 89
1 vote
1 answer
394 views

Is using sensitive information to generate a UUID v5 considered secure?

Lets say I want to generate a name-based UUID using v5 of the RFC 4122 using sensitive information as the input (for example the password to my bank account). And lets say I give the generated UUID to ...
user avatar
  • 113
0 votes
1 answer
116 views

Should I obscure database primary keys for the frontend even if these ids are uuidv4 Ids?

After reading through the answers of the related question (the same question but about integer primary keys), I was wondering if there is any reason to hash uuidv4 primary keys and sending the hash to ...
user avatar
0 votes
1 answer
158 views

Best practices for generating and storing authorization codes and access tokens in OAuth server

I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any ...
user avatar
-1 votes
1 answer
250 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
user avatar
1 vote
1 answer
842 views

using Uuid for security

I read that uuid does not bring any security advantages But I can't find why It doesn't bring a little bit of extra security in the scenario below ?: Consider that right now the session id is ...
user avatar
  • 13
0 votes
1 answer
157 views

Exposing UUID or BIGSERIAL Primary Keys

Exposing primary keys is bad practice. How should I expose UUID or BIGSERIAL Primary Keys to clients — hashing, encoding, encrypting? For integers there are libraries like hashids, what about UUID?
user avatar
  • 301
0 votes
1 answer
79 views

Understanding patch for my report

I reported a flaw to the security team and they changed the UIDs from regular integers to hash kind of a thing. Like this, XXXX-XXXX-and-so-on I still want to try and bypass things but I don't ...
user avatar
  • 1
0 votes
0 answers
119 views

Is it possible to get the original UUID1 from a timestamp?

Say, for example, I generate a time based UUID with the following program. import uuid uuid = uuid.uuid1() print uuid print uuid.time I get the following: 47702997-155d-11ea-92d3-6030d48747ec ...
user avatar
  • 43
3 votes
1 answer
919 views

UUID as auth token [duplicate]

I am working on a small IOT device that basically is a status display, which includes data about my phone. That means that I have a simple web server running, which can be used to update the devices ...
user avatar
5 votes
1 answer
1k views

Are GUIDs safe for long lived access tokens?

There is a peice of software i am using at work that has several components to it, lets call them the server and agents. the server runs an api over https that the agents use to communicate with it. ...
user avatar
  • 53
0 votes
1 answer
521 views

Passing user ID as parameter without any authentication, what are the security risks?

I've read that passing GUID as URL parameter isn't considered insecure because usually, an app has an authentication mechanism (checking against some session token). However, how secure would an ...
user avatar
0 votes
1 answer
1k views

Identifying devices in mobile app using UUID

I have a mobile application, for Android and iOS (both native), that communicates with the backend through a REST API (over HTTPS). The application allows users to sign in or use the app as a guest, ...
user avatar
  • 101
0 votes
1 answer
116 views

COM Classes CLSID

Would malware ever create a CLSID or would they just use them? This question is derived from studying COM objects. So an Adobe exploit would have an Adobe CLSID in it. Does malware ever create a CLSID ...
user avatar
1 vote
2 answers
146 views

Purpose of using GUID for files along with underlying permissions checks

Some sites utilize a GUID for a file name when it goes in storage. For example, when you load up a receipt, instead of having the receipt named something like 1200 (an incremental number), it will ...
user avatar
  • 11
0 votes
2 answers
181 views

How to solve the problem of secure randomly generated GUIDs when the size of the data outgrows the GUIDs

I've been struggling with this problem for a little while... How to hide the order that records were created in, basically. You typically do this by generating a "GUID". But this GUID is arbitrarily ...
user avatar
  • 548
2 votes
0 answers
568 views

Using a GUID as an authentication token (and how it could be improved)

I'm implementing a Whatsapp Web-like feature for my Android application. User should be able to open an HTTPS web application that displays a QR code (a GUID generated by the server) and scan it using ...
user avatar
2 votes
1 answer
514 views

Mobile application authentication using UUID

I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is: When user signs in, device sends username and ...
user avatar
  • 121
0 votes
1 answer
392 views

Using the user's GUID-id as a salt for Rfc2898DeriveBytes

I use the Rfc2898DeriveBytes for creating an AES key for protecting the user's data. For the salt value I would like to use the user's id, which is a guid. My understanding is, that the only drawback ...
user avatar
  • 103
17 votes
4 answers
11k views

Using V4 UUID for authentication

I'd like to use a V4 UUID / GUID for authenticating users. To be specific, the user would have to paste the UUID into a text field to gain access to their account. The UUID would be given to them at ...
user avatar
  • 171
0 votes
1 answer
19k views

Why does UUID v4 have the format xxxxxxxx-xxxx-4xxx-zxxx-xxxxxxxxxxxx? [closed]

I'm very curious as to why the format is xxxxxxxx-xxxx-4xxx-zxxx-xxxxxxxxxxxx? Why is the 4 there, and why is z always either 8, 9, A, B? And also, why the different string lengths between the dashes? ...
user avatar
  • 11
0 votes
1 answer
521 views

With a very large number of GUIDs, can one predict the previous and subsequent GUIDs that will be generated?

I've been reading up on GUIDs. According to the Wiki: Cryptanalysis of the WinAPI GUID generator shows that, since the sequence of V4 GUIDs is pseudo-random, given full knowledge of the internal ...
user avatar
  • 1,407