Suggestion regarding MySql ID column - Rails -

in rails app, instead of creating default mysql/postgres id columns integers, easy guess next number while hitting routes, best way generate id column ( alphanumeric may be?) going hard guess.

i did research on creating uuid's, option? or, there other options?

how generating epoch timestamps , storing them id's on before_save callback each time ?

usings uuid's cover database ids example of security obscurity.

"system security should not depend on secrecy of implementation or components." - national institute of standards , technology

consider cases attacker use knowledge of primary key attack system - sql injection (you're screwed anyways), , brute force attacks. should have better guards in place.

that being said there valid use cases using uuid's - main 1 being distributed databases using sequential auto increment columns prone race conditions.

if have several "write" replications extensive steps have taken make sure id's in sync , problems can occur if records inserted simultaneously in different databases.

when generating unique id hashing algorithm low chance of collision should used. sha-1 algorithm recommended rfc4122. earlier standards used scheme generating computer mac address combined timestamp not deemed opaque enough 1.

mongodb uses 8 bit object id identifiers default - ties in fact built replicate. mongodb uses following construct object ids:

• a 4-byte value representing seconds since unix epoch,
• a 3-byte machine identifier,
• a 2-byte process id, and
• a 3-byte counter, starting random value.

note these generated database - not web server utilising database.

there several esoteric algorithms designed have high uniqueness without cost of designated password hashing algorithm such blowfish.

conclusion:

use uuid's if can foresee have scaling problem requires database duplication.

whatever algorithm use strong enough avoid pigeonhole problems - should not roll own - problem has been extensively researched , there solutions many man hours behind them available free.

the security gains marginal @ best.