4 ms·
Encrypting would be pointless. Hashing would be possible, but then you break things like email notifications and password resets.
by whichdan 13y ago
Encrypting would be pointless. Hashing would be possible, but then you break things like email notifications and password resets.
- umsm 13y agoUpon a password reset submit, check if the hash(email_submit) exists, if so, email the password reset instructions to the email_submit address :)
- rozap 13y agoStill, notifications would be toast. Thought most email notifications are annoying, they can be useful (or crucial).
- umsm 13y agoIf you don't need email notifications, then it's not a problem. One nice feature from gmail/yahoo/outlook/etc.: temporary email addresses that forward to your email. This would solve the problem. Or, maybe alternative notification methods are preferred? If they wanted, a user can input an email address with a plus (if they're using gmail) and then receive notifications only on that. If the user wanted, then they could block all incoming messages that match that generated email.
- unclebucknasty 13y agoWhy is encrypting pointless if you generate the equivalent of a private key in code? Of course, if the attacker also gets the code, then you're toast, but getting the code is not guaranteed. So, seems like you'd have some additional protection with encryption.