Date: Tue, 18 Mar 2008 15:36:13 -0400
From: "D'Arcy J.M. Cain" <darcy@druid.net>
To: Steve Midgley <public@misuse.org>
Cc: lance@uiuc.edu, pgsql-sql@postgresql.org
Subject: Re: Create on insert a unique random number
Message-Id: <20080318153613.364cf08d.darcy@druid.net>
In-Reply-To: <20080318192351.4AD972E0041@postgresql.org>
References: <20080318190314.94E2A24A9A4@maia-3.hub.org>
	<20080318192351.4AD972E0041@postgresql.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Tue, 18 Mar 2008 12:23:35 -0700
Steve Midgley <public@misuse.org> wrote:
> 1) Create a second field (as someone recommend on this list) that is an 
> MD5 of your primary key. Use that as your "accessor" index from the web 

I strongly disagree for three reasons.  First, if you are going to
generate a key then don't store it.  Just generate it every time.
Second, don't generate it based on a known field.  You may think that
it is secure but what if you private key is compromised?  Do you then
change everyone's security code?  Third, what if one person's
code is compromised?  If it is based on a calculation then you
can't change that one person's security code.

Generate a random number and store that.  You will be much happier when
something goes wrong and something always goes wrong.

-- 
D'Arcy J.M. Cain <darcy@druid.net>         |  Democracy is three wolves
http://www.druid.net/darcy/                |  and a sheep voting on
+1 416 425 1212     (DoD#0082)    (eNTP)   |  what's for dinner.