3 ms·
Informations we store [...] Hashed value of your email okay, so you can easily make a rainbow-table and thus your users are not anonymous anymore + if someone
by ralfk 10y ago
Informations we store [...] Hashed value of your email
okay, so you can easily make a rainbow-table and thus your users are not anonymous anymore + if someone has your database and want to know if email@email.com has an account one can easily find that out, even without the need to bruteforce all emails.
Btw. in this case it makes absolutely no difference if you or the client computes the hash ;)
- stubish 10y agoYou are assuming a lack of salt when the client hashes the password.
- ralfk 10y agoYou are right, in this case he can use a salt for the hash - my second point is still valid though, but I guess that is fundamentally so if you want to use passwords
- ahomeDesk 10y agoWhile there is no 100% secure system, we are working very very hard to make our system as much secure as possible.