I'm writing an e-commerce system that uses BIP32 to generate addresses. I was thinking of using the order number (which is shown to the user) to as the index for generating the address to pay to.

Would doing this help someone trying to steal my money, or help someone trying to link my addresses together?