title: Using MongoDB generated _ids as "secret data" (eg, OAuth Tokens)
body: <p>Are MongoDB <code>_id</code> fields sufficiently random / unguessable to act as secret data?</p>
  
  <p>For example: if I'm building a server-side OAuth, could I use the _id as the OAuth Token for the user? I want to do this because of the cleanliness &amp; indexability it gives the database (eg, "tokens._id" => oauth_token).</p>
  
  <p>Inspecting the structure of MongoDB _id objects, they do seem to be decently random, but I do have some lingering concern about a malicious entity brute-force guessing one.</p>