4 ms·
That is incorrect. SHA1 still has no known collisions despite years of research and computing power dedicated to finding just one collision. Edit: Furthermore
by jwegan 15y ago
That is incorrect. SHA1 still has no known collisions despite years of research and computing power dedicated to finding just one collision.
Edit: Furthermore since the set of valid emails and phone numbers is a very restricted set of input, it is extremely likely that there are literally no two valid email/phone numbers that SHA1 hash to the same value.
- Me1000 15y agoThat's a fair assessment,
- hythloday 15y agoI agree that it's practically not a concern, but the local part of an email address[0] is up to 64 characters in an alphabet of size 72, and the domain part is 253+ characters in an alphabet of size 38, giving the valid email space a size of greater than 3e519, which is enough to guarantee collisions in SHA-512 and all of the SHA-3 finalists. [0] http://tools.ietf.org/html/rfc3696 http://tools.ietf.org/html/rfc3696
- fleitz 15y agoIf the set of data did contain 3e519 entries then yes it certainly would generate collisions, however it you look at a more restrictive set of data, lets say 5 emails per person alive then you're looking at about 2^35 email addresses which could easily be hashed by MD5 with out a significant chance of collision. Instead of an MD5 they could just as easily upload a bloomfilter which would expose even less data and would compress it significantly, however it would be more computationally expensive to generate matches that way vs. hashing.
- foobarbazetc 15y agoThat's irrelevant, since this isn't crypto. This is matching user email addresses so they can spam you and your friends and grow their company on the back of dodgy practices.