[pests]

How would a one-way hash even work? They already have a database of views for a video by its ID. If they hash those beforehand that solves nothing. They have the actual ID for that hash - they have to, cause they need to provide you data on it.

It could work similar to how haveibeenpwned works - send a prefix of the video ID and respond with a list of all matching IDs with that prefix. The server only knows the list not the actual video. The client can pull the correct ID out of the list.

(this was how HIBP worked before at least, IIRC)

[emodendroket]

They'd have to key the votes by the hash.

[pests]

A lot of trust they don't keep a map from hash->id behind the scenes though for data they already have.

Hell, a YT ID is 11 characters in a base64 character set. While a lot of possibilities, I do think the entire domain can be precomputed for some amount of costs.

[emodendroket]

I didn't say it was a wonderful or even good scheme; I said it was the best I could think of.