Reply to thread

Message: [QUOTE="Arne Vajhøj, post: 5050478"] It meets the stated requirements of being unique. But the original poster most likely have a requirement he forgot to mention: that it should be hard to guess as well. The point of emailing a confirmation link is to ensure that the registrant indeed own the email address. If the link is guessable then there is no point. UUID's are not intended to be cryptographic secure, so they are not the right toll for the job. The correct approach is to use a cryptographic secure RNG to generate a number of random bytes. Being slightly paranoid I will recommend generating maybe 100 bytes and do a SHA-256 of that just to protect against weaknesses. It does not cost much coding or many resources runtime, so I can not see any reason to not do it the right way. Arne [/QUOTE]