Hacker News new | past | comments | ask | show | jobs | submit login

Keep in mind too, that the data involved is all small enough that rainbow tables could easily be used to reverse them. My cell phone number's unsalted MD5 hash is trivially reversable via a google search - and if you salted it, you couldn't then compare it to the hash out of someone else's address book.

I've seen rainbow tables claiming 100% coverage of all <14 lowercase characters. I'd bet reasonable money that there's a rainbow table specifically generated for email-address-like strings and another for name-like-strings. I'm pretty sure both names and email addresses have a lot less entropy than random lowercase letter for the same lengths.

Using hashes to obfuscate while still maintaining comparison ability of low entropy data really doesn't help security much…




Particularly because 85% of "average" people in north america keep their email in one of 5 mail domains (hotmail.com, aol.com, yahoo.com, gmail.com, Facebook.com) - that, plus the low entropy of names - means the rainbow tables would probably have a 95% hit rate at relatively small sizes.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: