From: D'Arcy J.M. Cain <darcy@druid.net>
To: Steve Midgley <public@misuse.org>
Cc: lance@uiuc.edu
Cc: pgsql-sql@postgresql.org
Subject: Re: Create on insert a unique random number
Date: Tue, 18 Mar 2008 15:36:13 -0400
Message-ID: <20080318153613.364cf08d.darcy@druid.net> (raw)
In-Reply-To: <20080318192351.4AD972E0041@postgresql.org>
References: <20080318190314.94E2A24A9A4@maia-3.hub.org>
<20080318192351.4AD972E0041@postgresql.org>
On Tue, 18 Mar 2008 12:23:35 -0700
Steve Midgley <public@misuse.org> wrote:
> 1) Create a second field (as someone recommend on this list) that is an
> MD5 of your primary key. Use that as your "accessor" index from the web
I strongly disagree for three reasons. First, if you are going to
generate a key then don't store it. Just generate it every time.
Second, don't generate it based on a known field. You may think that
it is secure but what if you private key is compromised? Do you then
change everyone's security code? Third, what if one person's
code is compromised? If it is based on a calculation then you
can't change that one person's security code.
Generate a random number and store that. You will be much happier when
something goes wrong and something always goes wrong.
--
D'Arcy J.M. Cain <darcy@druid.net> | Democracy is three wolves
http://www.druid.net/darcy/ | and a sheep voting on
+1 416 425 1212 (DoD#0082) (eNTP) | what's for dinner.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: darcy@druid.net, public@misuse.org, lance@uiuc.edu
Subject: Re: Create on insert a unique random number
In-Reply-To: <20080318153613.364cf08d.darcy@druid.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox