And then some script kiddie from 4chan with a GPU outs all the plaintexts, and/or sets up a Twitter bot to automate it. Be very, very careful with ad-hoc security "protocols" like this. Especially when your livelihood may be at stake.https://twitter.com/Dharlette/status/944183293653733376 …
-
Show this thread
-
This is like that Catalonia hashed database for voter identification that ended up outing national ID / birthday / zipcode associations. Hashes aren't magical pixie dust. If the search space is bruteforceable, they amount to the illusion of security.
2 replies 13 retweets 24 likesShow this thread -
If you *must* do this (and understand the risks), either use full legal names to maximize entropy and a very strong salted hash, like say bcrypt/scrypt tuned to take 5 seconds per hash on a CPU, or similar...
2 replies 3 retweets 15 likesShow this thread -
... or use a very *weak* hash, like the 6-digit prefix of the SHA1 (24 bits), to guarantee collisions and thus make it a probabilistic filter and not something you could brute force usefully.
5 replies 1 retweet 18 likesShow this thread -
Replying to @marcan42
none of which helps if someone knows you and your likely abusers
1 reply 0 retweets 2 likes
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.