Re: Generating unique session ids

[Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>]

Tomasz Ostrowski <tometzky(at)batory(dot)org(dot)pl> writes:
> * When somebody knows md5('secret_salt' || '5') he will be able to
> easily compute
> 	md5('secret_salt' || '50')
> 	md5('secret_salt' || '51')

Sure, but can't you fix that by putting the secret part at the end?

> * PostgreSQL integers (as returned by nextval()) are 4 bytes. This
> means only 32 bit strength - much too low for today computers.

Um, nextval returns int8.

> * Any database user is most of the time able to read function
> bodies, so anybody who is able co connect to your database will be
> able to get your 'secret_salt' and then predict session id's.

Yeah, it's not clear where to hide the secret.

			regards, tom lane