Hector Martin

This is like that Catalonia hashed database for voter identification that ended up outing national ID / birthday / zipcode associations. Hashes aren't magical pixie dust. If the search space is bruteforceable, they amount to the illusion of security.

If you *must* do this (and understand the risks), either use full legal names to maximize entropy and a very strong salted hash, like say bcrypt/scrypt tuned to take 5 seconds per hash on a CPU, or similar...

... or use a very *weak* hash, like the 6-digit prefix of the SHA1 (24 bits), to guarantee collisions and thus make it a probabilistic filter and not something you could brute force usefully.

Keeping there names a secret is not the point. Its against it actually. It just about getting some time to find others, without dropping a plaintext Google spreadsheet.

I know. And I'm saying that won't work after someone writes a Twitter bot to reverse the hashes in seconds for the lulz, turning the approach into the equivalent of a plaintext Google spreadsheet.

Oh wow, public records that are meant to be accessible for other interested people are not fully secure? Who in the sec community would see that coming?!

I dunno, ask the OP, she seems to think it's not a problem and not worth discussing, considering, or making clear to those using this scheme.

So you just assume that a bunch of women in the security industry have no idea what they are doing, while its quite obvious, and you can't understand why they are not interested in you explaining obvious stuff to them? Should I further explain why?