6 ms·

Would encrypting the email addresses be feasible? They do seem to have a lot of value to hackers, but I'm not sure what the technical limitations would be for a

• whichdan 14y ago
  Encrypting would be pointless. Hashing would be possible, but then you break things like email notifications and password resets.
  • umsm 14y ago
    Upon a password reset submit, check if the hash(email_submit) exists, if so, email the password reset instructions to the email_submit address :)
    • rozap 14y ago
      Still, notifications would be toast. Thought most email notifications are annoying, they can be useful (or crucial).
      • umsm 14y ago
        If you don't need email notifications, then it's not a problem. One nice feature from gmail/yahoo/outlook/etc.: temporary email addresses that forward to your email. This would solve the problem. Or, maybe alternative notification methods are preferred? If they wanted, a user can input an email address with a plus (if they're using gmail) and then receive notifications only on that. If the user wanted, then they could block all incoming messages that match that generated email.
  • unclebucknasty 14y ago
    Why is encrypting pointless if you generate the equivalent of a private key in code? Of course, if the attacker also gets the code, then you're toast, but getting the code is not guaranteed. So, seems like you'd have some additional protection with encryption.