The OWASP web site recommends this:


Use per user or session indirect object references. This prevents attackers from directly targeting unauthorized resources. For example, instead of using the resource’s database key, a drop down list of six resources authorized for the current user could use the numbers 1 to 6 to indicate which value the user selected. [italics mine]
Check access. Each use of a direct object reference from an untrusted source must include an access control check to ensure the user is authorized for the requested object. [italics mine]


So if a user doesn't have access to the requested resource, how does obfuscating the direct object reference improve security?

Given the increased complexity that, say, an ASP.NET MVC site would accrue, is this worth the additional trouble for anything but banking sites?


Question: Psychology behind $0.99 for paid apps, but $1.00 for donation apps?
Answer: I know this question is old, and the purpose of misleading prices has been covered, but I don't see any explanations about why donations are round amounts.

Simply put, taking donations as whole numbers is more convenient for charities. 

They don't charge taxes or give change, so they list preset donation amounts without fractions of whole numbers (eg, cents) to make accounting easy, unless of course they accept coin donations in real life as well.

Asking for whole numbers is also more convenient for making donations. If you're using a web app to make a custom donation, it's easier to only have to enter one or two digits for the amount of dollars for example. In the real world, it's easier to only have to hand over one or two bills and maybe a handful of coins.