{"action":"created","issue":{"url":"https://api.github.com/repos/c2h5oh/hide/issues/5","repository_url":"https://api.github.com/repos/c2h5oh/hide","labels_url":"https://api.github.com/repos/c2h5oh/hide/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/c2h5oh/hide/issues/5/comments","events_url":"https://api.github.com/repos/c2h5oh/hide/issues/5/events","html_url":"https://github.com/c2h5oh/hide/issues/5","id":378468823,"node_id":"MDU6SXNzdWUzNzg0Njg4MjM=","number":5,"title":"Question about readme","user":{"login":"qgustavor","id":1020670,"node_id":"MDQ6VXNlcjEwMjA2NzA=","avatar_url":"https://avatars3.githubusercontent.com/u/1020670?v=4","gravatar_id":"","url":"https://api.github.com/users/qgustavor","html_url":"https://github.com/qgustavor","followers_url":"https://api.github.com/users/qgustavor/followers","following_url":"https://api.github.com/users/qgustavor/following{/other_user}","gists_url":"https://api.github.com/users/qgustavor/gists{/gist_id}","starred_url":"https://api.github.com/users/qgustavor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qgustavor/subscriptions","organizations_url":"https://api.github.com/users/qgustavor/orgs","repos_url":"https://api.github.com/users/qgustavor/repos","events_url":"https://api.github.com/users/qgustavor/events{/privacy}","received_events_url":"https://api.github.com/users/qgustavor/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-11-07T21:05:40Z","updated_at":"2018-12-04T21:11:55Z","closed_at":"2018-12-04T21:02:23Z","author_association":"NONE","body":"> * Base64-encoded IDs (Youtube-like):\r\n>    * they are just regular autoincrement IDs displayed in a different format that is trivial to reverse\r\n \r\nYouTube IDs are [Base64 encoded using the URL variant](https://en.wikipedia.org/wiki/Base64#URL_applications). That's verificable because it ignores the higher bits when decoding. Example: [jNQXAC9IVRw](https://www.youtube.com/watch?v=jNQXAC9IVRw), [jNQXAC9IVRx](https://www.youtube.com/embed/jNQXAC9IVRx), [jNQXAC9IVRy](https://www.youtube.com/embed/jNQXAC9IVRy), [jNQXAC9IVRz](https://www.youtube.com/embed/jNQXAC9IVRz) returns the same video.\r\n\r\nThe issue is \"that is trivial to reverse\": can you source that? If would trivial to reverse then unlisted videos wouldn't work. My guess is that YouTube is taking the \"autoincrement ID\", encrypting it with [some 64-bit block cipher](http://en.citizendium.org/wiki/Block_cipher/Catalogs/Cipher_list#64-bit_blocks) then encoding using Base64."},"comment":{"url":"https://api.github.com/repos/c2h5oh/hide/issues/comments/444259836","html_url":"https://github.com/c2h5oh/hide/issues/5#issuecomment-444259836","issue_url":"https://api.github.com/repos/c2h5oh/hide/issues/5","id":444259836,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NDI1OTgzNg==","user":{"login":"qgustavor","id":1020670,"node_id":"MDQ6VXNlcjEwMjA2NzA=","avatar_url":"https://avatars3.githubusercontent.com/u/1020670?v=4","gravatar_id":"","url":"https://api.github.com/users/qgustavor","html_url":"https://github.com/qgustavor","followers_url":"https://api.github.com/users/qgustavor/followers","following_url":"https://api.github.com/users/qgustavor/following{/other_user}","gists_url":"https://api.github.com/users/qgustavor/gists{/gist_id}","starred_url":"https://api.github.com/users/qgustavor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qgustavor/subscriptions","organizations_url":"https://api.github.com/users/qgustavor/orgs","repos_url":"https://api.github.com/users/qgustavor/repos","events_url":"https://api.github.com/users/qgustavor/events{/privacy}","received_events_url":"https://api.github.com/users/qgustavor/received_events","type":"User","site_admin":false},"created_at":"2018-12-04T21:11:55Z","updated_at":"2018-12-04T21:11:55Z","author_association":"NONE","body":"I think that comparison with YouTube is not fair because Base64 is just the\nencoding, it don't handles integer obfucation.\n\nOf course, someone could take the result from your library (or similar) and\nreinterpret in other base: decoding or encoding from some base it's just a\nmatter of presentation, what's important for the obfuscation is hiding the\ndata behind it.\n\nSo I could use store my integers in a 8 byte buffer, encrypt those with\nTriple DES and encode with Base64. Of course, it's trivial to reverse the\nBase64 step, what is not trivial is reversing the encryption step. Then if\nyou're going to compare your library with YouTube don't consider only the\nfinal step, but all steps.\n\nIf YouTube could be using cryptography then their implementation is good:\nit's not trivial to reverse (maybe impossible without the key), easy to\nimplement (on Node there's the crypto module), fast (on my computer OpenSSL\ncan process over one million 64 byte blocks per second using AES) and\nversatile (they used Base64, but they could use Base32 or any other\nencoding).\n\nThe issue - that your library don't have - IIRC - is that if you use crypto\nyou will get a large obfuscated value… unless you use less secure ciphers\nthat allows smaller block sizes. There's also homomorphic encryption, but\nall NPM libraries for that I checked are insecure: one of those implements\na simple and weak substitution cipher.\n\nThe readme issue aside, IMHO thinking about this maybe can lead a good\nimprovements in your library.\n\n2018/12/04 18:34 \"Maciej Lisiewski\" <notifications@github.com>:\n\nBase64 encoded IDs are trivial to reverse if that's the only thing you're\ndoing. I'm going to clarify that, because this ticket shows it's possible\nto assume based on the README that I claim this the only thing Youtube is\ndoing.\n\n—\nYou are receiving this because you authored the thread.\nReply to this email directly, view it on GitHub\n<https://github.com/c2h5oh/hide/issues/5#issuecomment-444247870>, or mute\nthe thread\n<https://github.com/notifications/unsubscribe-auth/AA-S_owpJ80i_MU-lO8s3XfO6kLTUuHRks5u1tw6gaJpZM4YTRev>\n.\n"}}
{"actor":{"display_login":"qgustavor"}}