Some main weaknesses, if I recall correctly, is that's incremental ids make scraping pretty easy, or guessing content outside of a URL given explicitly by the service (like here).
Yep, you're correct. Panera had an issue where folks could scrap every user profile due to sequential profile ids. The bigger part of the exploit was they just openly exposed user data but making the profiles ids sequential made it really easy to scrap
Comments
It's pretty common outside of rails too, like https://facebook.com/4
Some main weaknesses, if I recall correctly, is that's incremental ids make scraping pretty easy, or guessing content outside of a URL given explicitly by the service (like here).
They also leak metrics (#of registered users)
ALTER SEQUENCE "seq_user_id" RESTART WITH 5000000000
Wheres my billion dollars
I think this is the only downside.
Yep, you're correct. Panera had an issue where folks could scrap every user profile due to sequential profile ids. The bigger part of the exploit was they just openly exposed user data but making the profiles ids sequential made it really easy to scrap
https://krebsonsecurity.com/2018/04/panerabread-com-leaks-mi...
Also, competitors can analyze your growth more easily.