Identity columns and security in a RESTful web application
**Question**

Should autoincremented identity columns have a non-default seed/increment when used in a RESTful web application?

**Background**

I'm working on my first ASP.NET MVC application and trying to keep my urls RESTful.  There is no separate administrative web site for the application.  I use attributes to control who can access what parts of the site and what menu items are visible to the current user based on their roles in the system.  I (mostly) follow the ActiveRecord DB pattern and use synthetic ids for my tables, including the user table, with the ids being autogenerated identity columns.

It occurred to me this morning that there is a subtle security risk to using default seeds for identity columns in a RESTful application.  If you assume that administrative ids, particularly the most powerful ones, are typically created first in an application, then it follows that they will be the lowest numbered ids in the system.  While not actually opening a hole in the application, using default values for the seed/increment could make it easier for a cracker to attack a high value target simply by targeting low numbered ids using RESTful actions (such as ChangePassword -- which is one of the out-of-the-box actions in the ASP.NET MVC site template).

Should I add setting a non-default seed to, at least, my users table to my arsenal of security best practices? Is the effect of doing this worth it? Or am I being too paranoid? As a related question, should I be changing the out-of-the-box template names for account-related actions.
Identity columns and security in a RESTful web application
===

**Question**

Should autoincremented identity columns have a non-default seed/increment when used in a RESTful web application?

**Background**

I'm working on my first ASP.NET MVC application and trying to keep my urls RESTful.  There is no separate administrative web site for the application.  I use attributes to control who can access what parts of the site and what menu items are visible to the current user based on their roles in the system.  I (mostly) follow the ActiveRecord DB pattern and use synthetic ids for my tables, including the user table, with the ids being autogenerated identity columns.

It occurred to me this morning that there is a subtle security risk to using default seeds for identity columns in a RESTful application.  If you assume that administrative ids, particularly the most powerful ones, are typically created first in an application, then it follows that they will be the lowest numbered ids in the system.  While not actually opening a hole in the application, using default values for the seed/increment could make it easier for a cracker to attack a high value target simply by targeting low numbered ids using RESTful actions (such as ChangePassword -- which is one of the out-of-the-box actions in the ASP.NET MVC site template).

Should I add setting a non-default seed to, at least, my users table to my arsenal of security best practices? Is the effect of doing this worth it? Or am I being too paranoid? As a related question, should I be changing the out-of-the-box template names for account-related actions.