IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [uuid]

Universally Unique Identifiers (UUIDs) are 128-bit numbers used to uniquely identify data. They are globally unique for practical purposes, with an almost negligible chance to being duplicate.

A Universally Unique Identifier (UUID) is a 128-bit number used to uniquely identify data. The term Globally Unique Identifier (GUID) is used by Microsoft and is considered synonymous.

UUIDs are not managed by a central authority and instead rely upon a large enough namespace to make collisions unlikely.

There are different "versions" of UUIDs, with version 1 and version 4 being the most widely adopted variants.

Version 1

This version is based upon the time of creation at 100-nanosecond resolution, as well as the MAC-address of the computer creating the UUID. For this reason, Version 1 UUIDs are considered to be "unsafe", as they leak information on the system that created the UUID, or the time at which it was created, which may or may not be problematic, depending on the individual threat model.

Version 4

This version generates UUIDs randomly, meaning that no information about the creator or the creation time of the UUID is being leaked. Version 4 is thus generally recommended, unless the creation time of a UUID is relevant.

26 questions
18
votes
4 answers

Using V4 UUID for authentication

I'd like to use a V4 UUID / GUID for authenticating users. To be specific, the user would have to paste the UUID into a text field to gain access to their account. The UUID would be given to them at the time of registration. The UUID would be…
legeek
  • 181
  • 1
  • 1
  • 3
5
votes
1 answer

Are GUIDs safe for long lived access tokens?

There is a peice of software i am using at work that has several components to it, lets call them the server and agents. the server runs an api over https that the agents use to communicate with it. the server can be cloud hosted or locally…
gordon
  • 53
  • 4
4
votes
1 answer

UUID as auth token

I am working on a small IOT device that basically is a status display, which includes data about my phone. That means that I have a simple web server running, which can be used to update the devices display using POST requests. On to my question:…
Schwefelhexa
  • 43
  • 4
4
votes
2 answers

How to reasonably hash a composite key into a UUID?

The Problem In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID. Solutions? The obvious first suggestion would be UUIDv5, however: It's based on SHA-1,…
Alex
  • 41
  • 1
  • 2
2
votes
0 answers

Using a GUID as an authentication token (and how it could be improved)

I'm implementing a Whatsapp Web-like feature for my Android application. User should be able to open an HTTPS web application that displays a QR code (a GUID generated by the server) and scan it using her device sending it back to the server. Above…
Alessandro
  • 121
  • 1
2
votes
1 answer

Mobile application authentication using UUID

I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is: When user signs in, device sends username and password to server If credentials are valid…
guest
  • 121
  • 2
1
vote
1 answer

Is using sensitive information to generate a UUID v5 considered secure?

Lets say I want to generate a name-based UUID using v5 of the RFC 4122 using sensitive information as the input (for example the password to my bank account). And lets say I give the generated UUID to a malicious user who wishes to reverse it and…
Cooper
  • 113
  • 4
1
vote
1 answer

using Uuid for security

I read that uuid does not bring any security advantages But I can't find why It doesn't bring a little bit of extra security in the scenario below ?: Consider that right now the session id is encrypting the auto-increment id (no uuid is used). If…
ELA
  • 13
  • 3
1
vote
2 answers

Purpose of using GUID for files along with underlying permissions checks

Some sites utilize a GUID for a file name when it goes in storage. For example, when you load up a receipt, instead of having the receipt named something like 1200 (an incremental number), it will have a GUID instead. What is the purpose of using…
Sam
  • 11
  • 1
0
votes
1 answer

I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?

What are some attacks I can try against this form of authentication? How do I test if they are cryptographically secure as well?
study man
  • 9
  • 1
0
votes
1 answer

UUIDs replacing inremental IDs in URLs

I am reading about implementing UUIDs in URLs instead of incremental IDs to reduce attack vectors using obfuscation. I plan to create a UUID from an incremental ID and store the UUID which would be used to access the data. As per the specification…
myol
  • 133
  • 4
0
votes
1 answer

Creating a unique password for each device/unit of the same product

We are currently working on an IoT product & having a hard time coming up with a strategy to create a unique password for each device/unit. I do understand that password based on a function of { serial number, CPU id, MAC address or timestamp } is…
Baranikumar Venkatesan
  • 635
  • 4
  • 12
0
votes
0 answers

Guessing UUIDv1 hashes?

I'm digging into UUIDv1 generation and bruteforce, in order to take control of a password reset feature of a website which sends a link with a get parameter token=UUIDvX. I'm trying to identify which version of UUID hashing algorithm the server…
T. Rode
  • 91
  • 5
0
votes
1 answer

Should I obscure database primary keys for the frontend even if these ids are uuidv4 Ids?

After reading through the answers of the related question (the same question but about integer primary keys), I was wondering if there is any reason to hash uuidv4 primary keys and sending the hash to the frontend instead. Since uuidv4 Ids are…
MADforFUNandHappy
  • 103
  • 3
0
votes
1 answer

Best practices for generating and storing authorization codes and access tokens in OAuth server

I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any best practices for generating authorization code and…
Jakub Žitný
  • 379
  • 1
  • 2
  • 9
1
2