i suppose a lot of sites don't think too much about it, but putting a user/account id in a url gives away quite a bit of information.  putting aside the recommendations for not putting an internal id in a url just because it may change and break existing links, there are some privacy concerns as well.<p>in a cms-type application, it may let a recently-subscribed customer (or competitor) know how many other customers are stored in the system, even if they can't view the other records.  it may also be used to determine a signup date if that is at all useful.<p>in file-hosting type scenarios like dropbox, it allows for brute force scanning like this.  instead of using /u/1, /u/2, use the user's username, or a randomly-generated key/guid associated that maps to the user's account.