not using auto_increment id fields

[eluser]bobqphp[/eluser]
I'm working on a little project now and wanted to use random character strings for user IDs and data object IDs, instead of auto-incrementing numerical IDs. is this considered bad practice? these web frameworks seem to be built on the premise of using the auto-increment IDs so I don't want to deviate from the standard without good reason.

speaking of which, my reason is that since user/object IDs are part of urls, I don't want someone to try iterating through data. for example, think of a photo-sharing site where photo pages looked like /view/3634/192462 where 3634 was the user's ID, and 192462 was the photo's ID. assuming a low-traffic site, it's plausible that if a user uploads multiple photos in one session they'd all have near-sequential IDs.

maybe I'm just getting paranoid over nothing, but I do like that random strings look, well, random. am I crazy?