Re: A UUID function for web developers

On Fri, Mar 18, 2016 at 4:29 PM, Jim Porter <[email protected]> wrote:
> You probably wouldn't get access to Version 1 UUIDs, since they leak
> client data that can be used for fingerprinting (most importantly, the
> MAC address). Version 2 UUIDs aren't often supported, so they're out
> too. That leaves versions 3, 4, and 5, all of which can be implemented
> in plain ol' Javascript, unless I'm mistaken.

I'm always fascinated by this obsession with UUID.  Everyone uses
version 4.  I've only rarely seen others used.  And in most cases, the
same function is better filled by a high-entropy string.

crypto.getRandomValues(new Uint8Array(16)).join(',').split(',').map(x
=> (parseInt(x,10) + 0x100).toString(16).slice(1)).join('')

Those 32 characters have more entropy than the 36 (or 38) characters
of a UUID.  Smaller still with a different encoding.  Base64 over 15
random octets produces 20 characters with plenty of entropy.