Hashes vs Numeric id's

Question

When creating a web application that some how displays the display of a unique identifier for a recurring entity (videos on YouTube, or book section on a site like mine), would it be better to use a uniform length identifier like a hash or the unique key of the item in the database (1, 2, 3, etc).

Besides revealing a little, what I think is immaterial, information about the internals of your app, why would using a hash be better than just using the unique id?

In short: Which is better to use as a publicly displayed unique identifier - a hash value, or a unique key from the database?

Edit: I'm opening up this question again because Dmitriy brought up the good point of not tying down the naming to db specific property. Will this sort of tie down prevent me from optimizing/normalizing the database in the future?

The platform uses php/python with ISAM /w MySQL.

Answer 1

Hashes aren't guaranteed to be unique, nor, I believe, consistent.

Answer 2

I typically use hashes if I don't want the user to be able to guess the next ID in the series. But for your book sections, I'd stick with numerical id's.

Answer 3

will your users have to remember/use the value? or are you looking at it from a security POV?

From a security perspective, it shouldn't matter - since you shouldn't just be relying on people not guessing a different but valid ID of something they shouldn't see in order to keep them out.

Answer 4

Yeah, I don't think you're looking for a hash - you're more likely looking for a Guid.If you're on the .Net platform, try System.Guid.

However, the most important reason not to use a Guid is for performance. Doing database joins and lookups on (long) strings is very suboptimal. Numbers are fast. So, unless you really need it, don't do it.

Answer 5

Using hashes is preferable in case you need to rebuild your database for some reason, for example, and the ordering changes. The ordinal numbers will move around -- but the hashes will stay the same.

Not relying on the order you put things into a box, but on properties of the things, just seems.. safer.

But watch out for collisions, obviously.

Answer 6

With hashes you

1. Are free to merge the database with a similar one (or a backup), if necessary
2. Are not doing something that could help some guessing attacks even a bit
3. Are not disclosing more private information about the user than necessary, e.g. if somebody sees a user number 2 in your current database log in, they're getting information that he is an oldie.
4. (Provided that you use a long hash or a GUID,) greatly helping youself in case you're bought by YouTube and they decide to integrate your databases.
5. Helping yourself in case there appears a search engine that indexes by GUID.

Please let us know if the last 6 months brought you some clarity on this question...

Answer 7

Unless you're trying to hide the state of your internal object ID counter, hashes are needlessly slow (to generate and to compare), needlessly long, needlessly ugly, and needlessly capable of colliding.

For inventory-like things, just use a sequential (or sharded) counter instead. If you migrate to a different database, you will just have to initialize the new counter to a value at least as large as your largest existing record ID. Pretty much every database gives you a way to do this.

If you are trying to hide the state of your counter, perhaps because you're counting users and don't want competitors to know how many you have, I suggest avoiding the display of your IDs. If you insist on displaying them and don't want the drawbacks of a hash, you might consider using a maximal-period linear feedback shift register to generate IDs.