Comment 8 for bug 1380669

Revision history for this message
Salvatore Orlando (salvatore-orlando) wrote :

the aspect that my analysis did not consider is that we're trusting the UUID generation process to be completely random.
If it is not, then an attacker might do an "informed guess" and increase his/her chances of guessing a UUID.

Still, this wont' grant enough criticality for an embargo IMHO.