The OWASP web site recommends this:


Use per user or session indirect object references. This prevents attackers from directly targeting unauthorized resources. For example, instead of using the resource’s database key, a drop down list of six resources authorized for the current user could use the numbers 1 to 6 to indicate which value the user selected. [italics mine]
Check access. Each use of a direct object reference from an untrusted source must include an access control check to ensure the user is authorized for the requested object. [italics mine]


So if a user doesn't have access to the requested resource, how does obfuscating the direct object reference improve security?

Given the increased complexity that, say, an ASP.NET MVC site would accrue, is this worth the additional trouble for anything but banking sites?


Question: guake not working
Answer: guake depends on notification-daemon:

$ apt-cache depends guake
guake
...
 Depends: notification-daemon
  dunst
  mate-notification-daemon
  notify-osd
  plasma-widgets-workspace
  xfce4-notifyd


It is a hard dependency, so one of those packages must be installed. You could try reinstalling notify-osd, which is the usual package for Unity, or install it if it isn't present. See if another of those packages is installed and mention it in any bugs you file, since it doesn't seem to work for guake.