Hacker News new | ask | show | jobs
by ralfk 3498 days ago
Informations we store [...] Hashed value of your email

okay, so you can easily make a rainbow-table and thus your users are not anonymous anymore + if someone has your database and want to know if email@email.com has an account one can easily find that out, even without the need to bruteforce all emails. Btw. in this case it makes absolutely no difference if you or the client computes the hash ;)

1 comments

You are assuming a lack of salt when the client hashes the password.
You are right, in this case he can use a salt for the hash - my second point is still valid though, but I guess that is fundamentally so if you want to use passwords
While there is no 100% secure system, we are working very very hard to make our system as much secure as possible.