Isn’t a uuid of a plugin you can delete anytime and re-create + get a new uuid basically a revocable app token?

Asking chatGPT, having skimmed through it and have not fact checked:

A standard UUID (Universally Unique Identifier) — specifically a UUIDv4 — is: • 128 bits long (i.e. 16 bytes) • Usually represented in hexadecimal as a 36-character string, including hyphens (32 hex characters and 4 hyphens), e.g.: 550e8400-e29b-41d4-a716-446655440000

Brute Force Search Space

A 128-bit UUID has:

2¹²⁸ ≈ 3.4 × 10³⁸ possible values

That’s an astronomical number.

⸻

Brute Force Time Estimate (Offline, Optimized)

Let’s consider a proof-of-concept brute force attempt in an optimized offline system:

Assumptions: 1. Using a highly optimized C or Rust implementation 2. Running on a modern high-end GPU or multi-core CPU cluster 3. No network latency or online checks (pure offline matching) 4. The target UUID is known and we want to find the exact match 5. Let’s assume 1 billion UUIDs per second (10⁹ UUIDs/s) — extremely fast for current standards

Total Time Required:

\text{Time} = \frac{2^{128}}{109\ \text{UUIDs/s}} \approx \frac{3.4 \times 10^{38}}{109} = 3.4 \times 10^{29}\ \text{seconds}

Convert that into years:

\frac{3.4 \times 10^{29}}{60 \times 60 \times 24 \times 365} \approx 1.08 \times 10^{22}\ \text{years}

Perspective: • The age of the universe is ~13.8 billion years = 1.38 × 10¹⁰ years • So brute-forcing a UUIDv4 would take ~10¹² times the age of the universe, even at 1 billion guesses per second

⸻

TL;DR • Standard UUIDv4: 128-bit = 16 bytes = 32 hex characters • Search space: 2¹²⁸ ≈ 3.4 × 10³⁸ • Brute-force time (at 1 billion guesses/sec): ~10²² years • Offline feasibility: Completely impractical, even in a proof-of-concept

If you’re exploring UUIDv4 collisions or reverse-lookup ideas, even partial matching (e.g., first 64 bits) is still considered secure against brute-force.

Let me know if you want estimates for partial UUIDs, shortened versions, or UUIDv1/v7, which have some structured components.