From: D'Arcy J.M. Cain <darcy@druid.net>
To: Campbell, Lance <lance@uiuc.edu>
Cc: Vivek Khera <vivek@khera.org>
Cc: pgsql-sql@postgresql.org
Subject: Re: Create on insert a unique random number
Date: Tue, 18 Mar 2008 15:24:14 -0400
Message-ID: <20080318152414.bb43eb00.darcy@druid.net> (raw)
In-Reply-To: <B10E6810AC2A2F4EA7550D072CDE8760CDDC34@SAB-FENWICK.sab.uiuc.edu>
References: <B10E6810AC2A2F4EA7550D072CDE8760CDDC32@SAB-FENWICK.sab.uiuc.edu>
<268179.51357.qm@web54301.mail.re2.yahoo.com>
<20080318165138.GA6578@a-kretschmer.de>
<B10E6810AC2A2F4EA7550D072CDE8760CDDC33@SAB-FENWICK.sab.uiuc.edu>
<6649C6F5-BEDE-4A66-A9A3-33CE95633A83@khera.org>
<B10E6810AC2A2F4EA7550D072CDE8760CDDC34@SAB-FENWICK.sab.uiuc.edu>
On Tue, 18 Mar 2008 13:40:42 -0500
"Campbell, Lance" <lance@uiuc.edu> wrote:
> Why use a random number as a primary key? Security via obscurity.
Something with very short shelf life but...
> I build web applications for a living. In most of my applications it is
> preferable to use a random primary key. Why?
I understand why you might need a random field. My question is, why
does it have to be the primary key? I'm also not sure why it has to be
unique. You can always base the URL on both the primary key and the
security field. Now you don't need to worry about collisions. In
addition the serial number can be a public reference to the record.
Off-topic but related, funny story, I was once in charge of a medium
sized ISP and some suit came to me and suggested that for extra
security we should not let users pick passwords that already existed in
the system. My response was "So the error message should be that
someone in the system already has the password that you tried to use?"
--
D'Arcy J.M. Cain <darcy@druid.net> | Democracy is three wolves
http://www.druid.net/darcy/ | and a sheep voting on
+1 416 425 1212 (DoD#0082) (eNTP) | what's for dinner.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: darcy@druid.net, lance@uiuc.edu, vivek@khera.org
Subject: Re: Create on insert a unique random number
In-Reply-To: <20080318152414.bb43eb00.darcy@druid.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox