Hacker News Reader

You don’t have to use a pk as public identifiers.

If this is your use-case, private serial pk and fully random public identifiers is a better trade off than uuid. V4 is inefficient as a pk and v7 leaks info too.

Many business don’t really have super secret customers/growth and don’t need to hide that info, but if you feel you do you can transition to uuidv4 (not v7) for public identifiers while keeping an efficient pk.

View on HN

You can be much simpler, you can always one-way-hash your primary keys (along with any pepper), if you wish to hide them. Still, use UUIDs freely.

One-way hash -> you need to store the result to look up based on it -> likely better off using random identifier, and not worry about hash weakness etc.

Random Identifiers -> UUIDs are (mostly) randomness, especially the v4 one. V7 leaks the time component, so you can hash that part (and randomize it again), of course in that case you'd need to have an explicit mapping and then lookup, but once you get to the internal identity you dont have to worry either.

As for the worries, most SHA family is good.

Reply on news.ycombinator.com