Comments (3)
Thanks, very good question!
Changing the alphabet is fine. But you have to remember four things:
- Change it once and stay with that modified alphabet forever. Obviously, if you change the alphabet again later, or if you somehow "lose" your alphabet, all IDs transformed so far will become invalid, i.e. pointing to the wrong resources.
- Shortening the alphabet makes your transformed IDs longer.
- Extending the alphabet makes your transformed IDs shorter. You don't have to worry about this if obfuscation is all you need, of course.
- Your alphabet must never contain duplicate characters.
And when using this library in general, you have to keep in mind that the ID transformation is "secure" only in the sense that it's "security through obscurity". If there is a "determined guesser", they will probably find a way to reverse the transformation. Against a layperson, however, that transformation will easily be enough as a defense.
In addition to that, an attacker will still be able to observe whether an ID is short (e.g. ms7
) or long (e.g. m29slqmdf8
), where the first one is a smaller number and the second one is a larger number, no matter what alphabet you're using. If you want to get rid of that property as well, and if you happen to work in PHP, you can use PHP-IDs, which is an extension of this library here.
After all, if you need to make guessing even harder, try non-sequential IDs such as UUIDs.
Does this help?
from shorturl.
This definitely helps, thanks for the detailed response! FWIW we are using mysql short UUIDs and then encoding them with this library.
We need the IDs to be easy(ish) to type using a touchscreen keyboard, so that's why we're not using just regular UUIDs. Unfortunately we've found that both the short UUID and the resulting encoded string is sequential, but I think now that we're throwing letters into the mix, the average person won't be able to guess, which is all we need.
Thanks again!
from shorturl.
the average person won't be able to guess, which is all we need
Definitely not! If that's really all you need, you should be fine.
All in all, that seems like a pretty reasonable solution for your use case. Especially in combination with MySQL's UUID_SHORT()
, this will work well.
Just make sure that the implementation that you're using supports 64-bit (unsigned) integers. I don't know which (language) version you're using from this repository, but not all do support that out of the box. Some have 32-bit support only. If you're unsure, try a single large number (outside the 32-bit space), or open an issue here.
from shorturl.
Related Issues (14)
- In the Java class, index should be casted as long HOT 2
- Note Limit up to 1999999999 HOT 2
- on 64bit php, PHP_INT_MAX is decoded as a float HOT 6
- in 64bit php, everything between 0x7ffffffffffffE00 - PHP_INT_MAX is returned as float HOT 1
- in 64bit php, everything >= 0xE33BF7209CBFD54 is decoded (or encoded?) incorrectly HOT 1
- Concurrency issue HOT 1
- Swift 4 version HOT 1
- Fixed lenght for output? HOT 1
- Supporting long/big-int numbers! HOT 2
- what if path starts with "2" HOT 4
- C version HOT 1
- Please look at my Gist for a way to enhance your ShortURL HOT 2
- golang? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from shorturl.