Received: from localhost (unknown [200.46.204.184]) by postgresql.org (Postfix) with ESMTP id 56EF02E01A4 for ; Tue, 18 Mar 2008 16:24:21 -0300 (ADT) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024) with ESMTP id 72335-02 for ; Tue, 18 Mar 2008 16:24:13 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.5 Received: from smaug.vex.net (smaug.vex.net [208.76.104.132]) by postgresql.org (Postfix) with ESMTP id 36FBD2E01A0 for ; Tue, 18 Mar 2008 16:24:16 -0300 (ADT) Received: from dilbert (dilbert.druid.net [207.35.13.14]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smaug.vex.net (Postfix) with ESMTP id EB02617E21; Tue, 18 Mar 2008 15:24:14 -0400 (EDT) Date: Tue, 18 Mar 2008 15:24:14 -0400 From: "D'Arcy J.M. Cain" To: "Campbell, Lance" Cc: "Vivek Khera" , Subject: Re: Create on insert a unique random number Message-Id: <20080318152414.bb43eb00.darcy@druid.net> In-Reply-To: References: <268179.51357.qm@web54301.mail.re2.yahoo.com> <20080318165138.GA6578@a-kretschmer.de> <6649C6F5-BEDE-4A66-A9A3-33CE95633A83@khera.org> X-Mailer: Sylpheed 2.4.8 (GTK+ 2.12.8; x86_64--netbsd) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200803/113 X-Sequence-Number: 30441 On Tue, 18 Mar 2008 13:40:42 -0500 "Campbell, Lance" wrote: > Why use a random number as a primary key? Security via obscurity. Something with very short shelf life but... > I build web applications for a living. In most of my applications it is > preferable to use a random primary key. Why? I understand why you might need a random field. My question is, why does it have to be the primary key? I'm also not sure why it has to be unique. You can always base the URL on both the primary key and the security field. Now you don't need to worry about collisions. In addition the serial number can be a public reference to the record. Off-topic but related, funny story, I was once in charge of a medium sized ISP and some suit came to me and suggested that for extra security we should not let users pick passwords that already existed in the system. My response was "So the error message should be that someone in the system already has the password that you tried to use?" -- D'Arcy J.M. Cain | Democracy is three wolves http://www.druid.net/darcy/ | and a sheep voting on +1 416 425 1212 (DoD#0082) (eNTP) | what's for dinner.