5 ms·
Just wondering if you could: 1. Hash first on the device (SHA-2, no salt) after converting to common case and removing extraneous characters from contact data.
by Intermernet 15y ago
Just wondering if you could:
1. Hash first on the device (SHA-2, no salt) after converting to common case and removing extraneous characters from contact data.
2. Send hashes over secure connection (SSL, TLS).
3. Hash again on the server (SHA-2, salted with value known only to service provider)
4. Delete all data a reasonable time after comparison / mapping is done.
This way, although it's not unbreakable, there are the advantages of:
- Encrypted, pre-hashed data over the wire.
- Easily comparable data on the server.
- Reasonably secure server side storage as long as the salt is secured.
Dumb idea?