Random ID - Revision history

Tom: /* Context */

2025-08-05T05:41:02Z

‎Context

Tom: /* Full Title or Meme */

2023-06-14T23:57:23Z

‎Full Title or Meme

Tom: /* Context */

2023-06-14T22:02:25Z

‎Context

Tom: /* Context */

2023-06-14T21:58:24Z

‎Context

Tom: /* Context */

2023-06-14T21:56:52Z

‎Context

Show changes

Tom at 21:55, 14 June 2023

2023-06-14T21:55:09Z

Tom: /* REferences */

2023-06-14T21:51:12Z

‎REferences

Tom: Created page with "Just create a random number that can be held in a private location on your device as use that as your ID or password if the site requires some on ID. ==REferences== Caegor..."

2023-06-14T21:50:21Z

Created page with "Just create a random number that can be held in a private location on your device as use that as your ID or password if the site requires some on ID. ==REferences== Caegor..."

New page

Just create a random number that can be held in a private location on your device as use that as your ID or password if the site requires some on ID.

==REferences==

[[Caegory: Authentication]]
[[Caegory: Identifier]]

@@ Line 4: / Line 4: @@
 ==Context==
-https://news.ycombinator.com/item?id=16159301
+* [https://news.ycombinator.com/item?id=16159301 What's the recommended method of adding authentication to a REST API?]
 I'm one of a bunch of people on Hacker News that do this kind of work professionally. Here's a recent comment on a recent story about it:

@@ Line 1: / Line 1: @@
 ==Full Title or Meme==
-Just create a random number that can be held in a private location on your device as use that as your ID or password if the site requires some on ID.
+Just create a random number that can be held in a private location on your device as use that and your ID or password if the site requires some other type of identifier..
 ==Context==

@@ Line 6: / Line 6: @@
 https://news.ycombinator.com/item?id=16159301
+I'm one of a bunch of people on Hacker News that do this kind of work professionally. Here's a recent comment on a recent story about it:
 https://news.ycombinator.com/item?id=16006394
 The short answer is: don't overthink it. Do the simplest thing that will work: use 16+ byte random keys read from /dev/urandom and stored in a database. The cool-kid name for this is "bearer tokens".
@@ Line 19: / Line 15: @@
 I agree that OAuth is not necessary on its own but it can be appropriate if you are also supporting delegated authentication with various 3rd parties : make your own native auth just another OAuth provider.
-You need transport encryption no matter what, not just for REST APIs. I'm just addressing the app design concerns.
+You need transport encryption no matter what, not just for REST APIs.
 yebyen on Jan 16, 2018 | root | parent | next [–]

@@ Line 16: / Line 16: @@
 Do not use JWTs, which are an increasingly (and somewhat inexplicably) popular cryptographic token that every working cryptography engineer I've spoken to hates passionately. JWTs are easy for developers to use, because libraries are a thing, but impossible for security engineers to reason about. There's a race to replace JWTs with something better (PAST is an example) and while I don't think the underlying idea behind JWTs is any good either, even if you disagree, you should still wait for one of the better formats to gain acceptance.
 Also remember to time out the tokens: it is almost never a good idea to permit infinitely long login sessions (surprising how often I see this not done). Again remember to invalidate the token when the user changes their password.
 I agree that OAuth is not necessary on its own but it can be appropriate if you are also supporting delegated authentication with various 3rd parties : make your own native auth just another OAuth provider.
 You need transport encryption no matter what, not just for REST APIs. I'm just addressing the app design concerns.

← Older revision		Revision as of 21:55, 14 June 2023
Line 1:		Line 1:
		+	==Full Title or Meme==
	Just create a random number that can be held in a private location on your device as use that as your ID or password if the site requires some on ID.		Just create a random number that can be held in a private location on your device as use that as your ID or password if the site requires some on ID.
		+
		+	==Context==
		+
		+	https://news.ycombinator.com/item?id=16159301

	==References==		==References==

@@ Line 1: / Line 1: @@
 Just create a random number that can be held in a private location on your device as use that as your ID or password if the site requires some on ID.
-==REferences==
+==References==
-[[Caegory: Authentication]]
+[[Category: Authentication]]
-[[Caegory: Identifier]]
+[[Category: Identifier]]