This is like that Catalonia hashed database for voter identification that ended up outing national ID / birthday / zipcode associations. Hashes aren't magical pixie dust. If the search space is bruteforceable, they amount to the illusion of security.
-
-
Show this thread
-
If you *must* do this (and understand the risks), either use full legal names to maximize entropy and a very strong salted hash, like say bcrypt/scrypt tuned to take 5 seconds per hash on a CPU, or similar...
Show this thread -
... or use a very *weak* hash, like the 6-digit prefix of the SHA1 (24 bits), to guarantee collisions and thus make it a probabilistic filter and not something you could brute force usefully.
Show this thread
End of conversation
New conversation -
-
-
I fail to see what you're getting at here. If the name can be brute forced from a wordlist of names, you might as well post the plaintext. It doesn't matter what your intention is. Yes, bcrypt helps, though it doesn't guarantee security either.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
No, because if you can use a Rainbow Table, then the *very specific threat* that using a hash instead of a plaintext name is trying to solve gets shifted onto the person who uses a Rainbow table to collate a list of abusers.
-
What is that "very specific threat", exactly?
- Show replies
New conversation -
-
-
Waiting for someone to make a cryptocurrency based on cracking hashes of names... Is there an ICO yet?
-
can do it with an ethereum contract no?
- Show replies
New conversation -
-
-
Could work with Argon2, but there are few enough names that it wouldn't take that long to work out the big players.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.