node-scuid icon indicating copy to clipboard operation
node-scuid copied to clipboard

Cuid has been deprecated because it (and all other non-crypto k-sortable ids) is insecure.

Open ericelliott opened this issue 2 years ago • 0 comments

Please upgrade to Cuid2.

Cuid has been deprecated due to security concerns. Likewise, UUID V4 may be insecure due to its reliance on the web crypto APIs, whose random number generators have historically gone years with known bugs that break cryptographic security (details in the Cuid2 documentation). All other UUIDs leak information which may be exploited.

Other ids that share these security concerns include Ulid, Snowflake, ShardingId, pushId, ObjectId, and KSUID. NanoId shares the same dependence on the web crypto API as UUID V4.

ericelliott avatar Jan 24 '23 22:01 ericelliott