[nish__]

Well where else do users have public profiles?

[0x3f]

The whole point though is that the ID itself leaks info, even if the profile is not public. There are many cases where you reference an object as a foreign key, even if you can't see the entire record of that foreign key.

[nish__]

I can't think of any.

[strbean]

Sending a friend request is an obvious example.

[nish__]

Ok but in that case, why not use the user ID as the primary key?