Comments (12)
The older PRNG is easier but the new one is similarly vulnerable. You need to switch to crypto.getRandomValues if you really want it to be unpredictable.
from cuid.
This should be fixed now.
from cuid.
FYI crypto is already available in most browsers.
from cuid.
@fta2012 just out of interest, if you can't know the timestamp portion can you ever crack the whole thing?
from cuid.
You just need to search upwards from the last known timestamp. Also if it's a batch insert the next id is likely to be within the same millisecond as the others.
from cuid.
I'm open to a PR, with a caveat. For such an attack to work:
- You'd need to be running an old/buggy PRNG
- The thing you're searching for would need to be generated by the same client, during the same runtime instance as the known IDs. You'd also need to be able to search the ID space to land on the right millisecond.
Some older apps may be vulnerable to an ID guessing attack.
from cuid.
Agreed. Open to a PR.
from cuid.
If it's just replacing Math.random with the crypto version it should be a small change. I probably won't get to it so this is up for grabs for anyone who wants to contribute.
from cuid.
The crypto API is not in the browser.
from cuid.
I don't think that cuids being predictable is necessarily a bad thing.
from cuid.
@MarkHerhold For some apps, it could be a security risk.
from cuid.
I'm open to a PR that uses the crypto API if it's available. Note that it is available in IE11 with the ms
prefix, so fallback to that if you can.
In Node, we'll have to use the Node crypto API to avoid this vulnerability... note that it is NOT compatible with universal JS, so we'll have to continue to use different builds for Node and Browsers. We could write a facade around the different APIs using a getRandomValues()
function and import a different implementation depending on the build.
from cuid.
Related Issues (20)
- Question: cuid compare to /dev/urandom HOT 1
- Port to Deno HOT 2
- Simple generator for testing/development
- Where do I find the standalone version? HOT 1
- Can we make it shorter? HOT 4
- How to compare cuids HOT 1
- Dependency Dashboard
- Fails to work with cloudflare workers js runtime. HOT 4
- Question: could we register a cuid: URI scheme, or URN scheme? HOT 2
- Question: Is there an active Java implementation? HOT 5
- Use of os.hostname() causes runtime crash on Wndows 7 HOT 3
- Is CUID good for a post App? HOT 1
- Usage of new Date().getTime() vs Date.now HOT 1
- Why does a cuid have so many zeros in almost every generated id? HOT 1
- Is there any easy way to mock this lib with jest? HOT 1
- Check character HOT 1
- cuid npm package does not mention the deprecated state HOT 1
- Document post-deprecation support timeframe HOT 2
- [deps] Check for breaking changes in Dependabot's PRs
- why is it deprecated, you could just add cuid2, mentioning the security issues associated with k-sortable ids
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cuid.