> you could probably use "for-jane" without risk of collision Sounds like it's begging for some troublemaker to build up a dictionary by cracking past exchange

> you could probably use "for-jane" without risk of collision Sounds like it's begging for some troublemaker to build up a dictionary by cracking past exchanges and stock wordlists then intercepting other people's sessions as they show up. (I know there is a timestamp based salt, but the attacker can even precompute the values for their dictionary far into the future) This feels like the tor HS enumeration attack but a lot worse, since once you find one you can intercept its traffic. It would be nice if there were a separate "name" and password, and the password used a zero knowledge secret comparison. Troublemakers could still block your sessions but they wouldn't have much luck trying to guess even fairly weak passwords.