Describe the security limitation? about obfuscate_id

[connormckelvey]

I think what the author is getting at is that the obfuscated id produced is predictable. The gem behind the integer hashing is buy the same author and claims to be reversible, where as AES is not a hash and cannot be reverse, but an encryption that requires a key to decrypt making identifying the actual DB id nearly impossible.

In my opinion a plain ID, an obfuscated id and an encrypted id are all face the same security issues for a REST API or something. It's SQL injection you need to worry about. In which case AES would obviously be most affective at preventing an injection that could modify someones email address based on ID, but the real need to is to secure the app from SQL injection.

[wbotelhos]

Hi @arjunmenon , this gem is not for crypto, it is about obfuscation.

Since this repository is kind deprecated, I created a gem with Hashids support, but it still about obfuscation: https://github.com/wbotelhos/idy

I would love your feedback.