469,312 Members | 2,503 Online
Bytes | Developer Community
New Post

Home Posts Topics Members FAQ

Post your question to a community of 469,312 developers. It's quick & easy.

GUIDs

Would a GUID be a good idea to use for a random generated account code. The
user will be given a link to pass the GUID and then be prompted for a
password.

Ex.
http://domain.com?id=0D1CB84F-82C0-4...4-8B22B41FA005

TIA...

--
Roland Hall
/* One out of three people crazy. Think of two friends. If they're ok,
you're nuts! */
Jul 22 '05 #1
8 1254
Personally, I don't like GUIDs because they're a pain. Many links you
create will wrap because of this long string if you send the link in an
e-mail, and nobody wants to try and type out a GUID to fix it (never mind
commit the value to memory).

Some other pros/cons:

http://www.aspfaq.com/2504

Why does it need to be random?

"Roland Hall" <nobody@nowhere> wrote in message
news:#k**************@tk2msftngp13.phx.gbl...
Would a GUID be a good idea to use for a random generated account code. The user will be given a link to pass the GUID and then be prompted for a
password.

Ex.
http://domain.com?id=0D1CB84F-82C0-4...4-8B22B41FA005

TIA...

--
Roland Hall
/* One out of three people crazy. Think of two friends. If they're ok,
you're nuts! */

Jul 22 '05 #2
"Aaron [SQL Server MVP]" <te*****@dnartreb.noraa> wrote in message
news:%2****************@TK2MSFTNGP10.phx.gbl...
: Personally, I don't like GUIDs because they're a pain. Many links you
: create will wrap because of this long string if you send the link in an
: e-mail, and nobody wants to try and type out a GUID to fix it (never mind
: commit the value to memory).
:
: Some other pros/cons:
:
: http://www.aspfaq.com/2504
:
: Why does it need to be random?

Better random than sequential. I've been testing and most mail, if
wrapping, will do so at 72-80 characters. I'm within that range.
Typing in the GUID would be a negative, hence the link.
And if able to commit to memory, that person has less on their mind than I.
So, marking you down in the 'no' column.

What do you suggest as an alternative?

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp
Jul 22 '05 #3
> Better random than sequential.

Why is that better? Again, why does it need to be random?

It's an absolutely meaningless surrogate value. If you want to take
guesswork out of it then use a bizarre increment, like 326 or 127.

Jul 22 '05 #4
"Aaron [SQL Server MVP]" wrote in message
news:ef**************@TK2MSFTNGP12.phx.gbl...
:> Better random than sequential.
:
: Why is that better? Again, why does it need to be random?

Thanks for responding.

Because I have security in mind. Being able to figure out an account code.
leaves you to work on just the password.

Ex. Why does it not pay to rename the administrator's account in NT?
Because the sid always ends with 500.
Ex. Why should a username/password logon never state a different response
for username vs password but should instead include them as one? (The
username/password you are using is not valid. Please try again or go
______/call ______ for support.) It lets the attacker know one of them is
correct, usually the username.

: It's an absolutely meaningless surrogate value. If you want to take
: guesswork out of it then use a bizarre increment, like 326 or 127.

Even if the increment is obscure, if it is not random, it has a pattern and
can be known easily.

It doesn't have to be a GUID but I would prefer it to be random and not just
numeric. I have already written a password creation routine which has
optional punctuations and optional random lengths between 8-15 characters.
Perhaps I will consider doing the same for the account code.

BTW... just asking but is this your alternative, a bizarre increment?

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp
Jul 22 '05 #5
> BTW... just asking but is this your alternative, a bizarre increment?

No, actually, I am not sure the user ever has to know the surrogate and
meaningless key you've applied to identify their account. Whether they use
?somePage=367 or
?somePage=big_long_stupid_string_here_that_WILL_wr ap_in_some_clients_no_matt
er_how_much_you_tested_it, they still have to map that to the e-mail address
that specific identifier was sent to.

You asked if it was a good idea, I think I've pointed out a couple of issues
with it, you're going to ignore those, so go ahead, use GUID, it must be a
fabulous idea. *sigh*
Jul 22 '05 #6
"Aaron [SQL Server MVP]" wrote in message
news:u3**************@TK2MSFTNGP15.phx.gbl...
:> BTW... just asking but is this your alternative, a bizarre increment?
:
: No, actually, I am not sure the user ever has to know the surrogate and
: meaningless key you've applied to identify their account. Whether they
use
: ?somePage=367 or
:
?somePage=big_long_stupid_string_here_that_WILL_wr ap_in_some_clients_no_matt
: er_how_much_you_tested_it, they still have to map that to the e-mail
address
: that specific identifier was sent to.
:
: You asked if it was a good idea, I think I've pointed out a couple of
issues
: with it, you're going to ignore those, so go ahead, use GUID, it must be a
: fabulous idea. *sigh*

And those were excellent points too. (O:=

You shouldn't take this personal. I respect your opinion(s). I may not
always agree but getting opinions of others helps me to make a decision and
generally provides knowledge of something I may not have considered. You
have valid points. I also never said I was going to ignore them. And, I
don't particularly like the GUID idea although I do use it to eliminate SPAM
(another discussion).

The email address is not relevant here because it is not the sending to the
user I am concerned with, in this discussion, but rather the attempt to
visit the link with a valid account and then attempt to brute force the
password. My goal was to make it difficult before they ever got to attempt
attacking the password.

I also stated in my last post, I would consider using my password creation
routine. A randomly sized alphanumeric case-sensitive account code might be
a strong enough defense, at least for the account code.

Perhaps I should explain what this is for...

The account is for subscriptions for fuel surcharges in my shopping cart.
Without the subscription, merchants will have to keep track of this
themselves to avoid losing money re: shipping should the price rise. With a
subscription, which will require the account code/password and known link,
the merchant will "Set it and forget it." Annual renewals will require a
logon, so only during the initial setup and renewal will this issue present
itself. Surely people will be able to copy/paste at a minimum once a year.

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp

Jul 22 '05 #7
> You shouldn't take this personal.

I wasn't taking it personal. It just started sounding an awful lot like,
"I've already made up my mind, but why don't you waste some time trying
anyway."
Jul 22 '05 #8
"Aaron [SQL Server MVP]" wrote in message
news:uq**************@TK2MSFTNGP10.phx.gbl...
:> You shouldn't take this personal.
:
: I wasn't taking it personal. It just started sounding an awful lot like,
: "I've already made up my mind, but why don't you waste some time trying
: anyway."

Sorry. If I had already made up my mind, I would not have asked. I am
always open for suggestions. I may be over thinking it because now I'm
considering an MD5 hash of various things which means the account can be
pretty much anything. The other goal is to make it difficult for my
customers to pay once, use many times. I know this is an impossible task
for some and will only have our agreement to protect me somewhat.

The difficult part is I am limited because I believe most of my customers
will have hosted web sites. Not all, like discountasp.net, will allow you
to have scripts scheduled.

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp
Jul 22 '05 #9

This discussion thread is closed

Replies have been disabled for this discussion.

Similar topics

5 posts views Thread by Jon Perez | last post: by
reply views Thread by Shaun Clark | last post: by
14 posts views Thread by David Wheeler | last post: by
4 posts views Thread by J.Marsch | last post: by
1 post views Thread by vector | last post: by
1 post views Thread by Andrew S. Giles | last post: by
11 posts views Thread by Jeff | last post: by
2 posts views Thread by Howard Kaikow | last post: by
reply views Thread by suresh191 | last post: by
reply views Thread by harlem98 | last post: by
1 post views Thread by Geralt96 | last post: by
reply views Thread by harlem98 | last post: by
By using this site, you agree to our Privacy Policy and Terms of Use.