Reply to thread

Message

[QUOTE="markspace, post: 5050486"]
I looked up"cryptographic secure" on Wikipedia, and I have to disagree.
The key he's sending is going out as plain text.  Cryptographically
secure RNGs are used to generate keys, you never reveal your seed value
or there's no point to the keys either.  The UUID is plenty hard to
guess; using a hard-to-guess value that you then send out as plain text
isn't going to improve your security.

Also, there's human factors to consider as well.  "Fake" but valid email
addresses are plenty easy to generate.  If someone really wants to use a
bogus address, they just make one, get the link you send them, and then
ignore the email address after that.  This whole process is easy to
automate.  Hundreds or thousands of fake ID per day can be generated
this way.  "Cryptographically secure" doesn't mean much when Alice and
Mallory are the same person.  In this case the human factor is a coder
who thinks "cryptographically secure" is going to solve some problem
when it won't.

If you can show me how UUIDs are "easy to guess," I might retract my
statements somewhat.
[/QUOTE]

Verification