Is UUID random enough for password recovery link?

Question

Does Data::UUID generates secure and random sequences? Is it ok to use it to generate password recovery link? For example:

use Data::UUID;
my $u = Data::UUID->new;
my $uuid = $u->create_from_name_str(NameSpace_URL, 'www.example.com');
#then add $uuid to db
#and send email to user

Answer 1

Personally I'd use UUID::Tiny because that's capable of generating version 4 UUIDs, which are more random. However, in either case the modules are just using Perl's rand function which isn't considered random enough for serious crypto work.

Still, this is likely to be random enough for a typical password-recovery e-mail. Especially if the password recovery link is only kept working for, say, 24 hours and stops working after that.

It really depends on what you're securing though. Is it a forum for posting pictures of your pets dressed in superhero costumes, or is it nuclear launch codes? If you think that your website is likely to be a target for criminal elements, then it might be wise to opt for something stronger.

A fairly good random string with low collision probability can be generated using:

use Crypt::PRNG;
my $string = sprintf(
    q/%08x%s/,
    time(),
    Crypt::PRNG->new->bytes_hex(24),
);