Hector Martin

And then some script kiddie from 4chan with a GPU outs all the plaintexts, and/or sets up a Twitter bot to automate it. Be very, very careful with ad-hoc security "protocols" like this. Especially when your livelihood may be at stake.https://twitter.com/Dharlette/status/944183293653733376 …

This is like that Catalonia hashed database for voter identification that ended up outing national ID / birthday / zipcode associations. Hashes aren't magical pixie dust. If the search space is bruteforceable, they amount to the illusion of security.

If you *must* do this (and understand the risks), either use full legal names to maximize entropy and a very strong salted hash, like say bcrypt/scrypt tuned to take 5 seconds per hash on a CPU, or similar...

... or use a very *weak* hash, like the 6-digit prefix of the SHA1 (24 bits), to guarantee collisions and thus make it a probabilistic filter and not something you could brute force usefully.

Keeping there names a secret is not the point. Its against it actually. It just about getting some time to find others, without dropping a plaintext Google spreadsheet.

I know. And I'm saying that won't work after someone writes a Twitter bot to reverse the hashes in seconds for the lulz, turning the approach into the equivalent of a plaintext Google spreadsheet.

Oh wow, public records that are meant to be accessible for other interested people are not fully secure? Who in the sec community would see that coming?!