I'm writing an e-commerce system that uses BIP32 to generate addresses. I was thinking of using the order number (which is shown to the user) to as the index for generating the address to pay to.
Would doing this help someone trying to steal my money, or help someone trying to link my addresses together?
I wouldn't expect stealing to become easier. BIP32 uses low incremental integer numbers, which are easily brute forceable if not predictable.
Same reasoning for linking addresses i guess.
I'll leave a real answer up to someone more knowledgeable though.
One consideration I'm sure you thought about is that you need to make sure the order number is unique (no address reuse). Even over multiple years (unless you use the year as one of the other HD indexes, I guess).
One downside is that if you ever load the private key into another wallet it probably won't find your money as it doesn't know your numbering system. Maybe that's an upside actually as it ads a layer of obfuscation to protect you from theft. Slippery slope though.
(Meant to type this as a comment instead of an answer, but i guess I'll leave it unless a better answer says it actually is dangerous.)
