Question

I am developing an app that enables existing users to invite their friends via e-mail. During the invitation process I generate a code to use in a link that the invited person clicks on to register.

Currently I am using the default hashcode generated from the their e-mail string, however this is probably pretty obvious and insecure.

I am considering using this:

Random random = new Random();
Integer code = random.nextInt()

But my instance of Random would need to be a singleton across my whole app ? And each time the app/jvm was restarted it would be “reset” thus making possible collisons where the same number is generated twice ?

Edit Actually the default hashcode isn’t that bad, an attacker would need to know that someone has been invited and what their e-mail was, and attempt to generate link in correct time frame (where invite is active).

Answer 1

You can append a (current) date/time string to the email address to make it unique.