API design and security: Why hide internal ids?

Question

I\'ve heard a few people say that you should never expose your internal ids to the outside world (for instance an auto_increment\'ng primary key).

Some suggest hav

Answer 1

Great answers, I'll add another reason to why you don't want to expose your internal auto incremented ID.
As a competitive company I can easily instrument how many new users/orders/etc you get every week/day/hour. I just need to create a user and/or order and subtract the new ID from what I got last time.
So not only for security reasons, it's business reasons as well.