Hacker News Reader

I'll admit I haven't dealt with wedding registries much at all (really, I watched somebody use a registry kiosk at a store once and that's about it) but I was always under the impression that registries are generally pretty much public.

View on HN

You're right. If you know the first and last name of either the bride or the groom, and the store at which they registered, you can access their registry. This is by design--stores want it to be easy to find what the B&G want, because they want it to be easy for you to buy something for them.

I could access a registry by guessing an ID (an ActiveRecord primary key, so just an integer), not searching for names. Agreed, this isn't very useful, but the list isn't protected/obscured if the URLs are that easy to guess.

For example, at Amazon Universal Wishlist, the ID of a valid wishlist is very hard to guess -- like 6HV8XSTGDT3E7-difficult. On top, you can select whether you want that list to be public (discoverable via name search), visible if one knows the link, or private.

Reply on news.ycombinator.com