title: Is auth.uid a shared secret?
body: <p>It appears that when someone authenticates via oAuth, Firebase creates a uid that looks something like <code>google:111413554342829501512</code>, for example.</p>
  
  <p>In Firebase rules, you can do (read and/or write):</p>
  
  <pre><code>".read": "root.child('users').child(auth.uid).child('isAdmin').val() == true"
  </code></pre>
  
  <p>Is it assumed that I can't read the message by sniffing the network because of the use of HTTPS?  Is this how it works - the UID is a shared key used by Firebase rules?</p>
  
  <p>I see that UID in <code>firebase:session::ack</code> in Local Storage in my browser once authenticated.</p>