4 ms·
Using bcrypt on email addresses is pants-on-head retarded. Please stop cargo-culting cryptography. How do you propose to look up accounts by email address if t
by stouset 12y ago
Using bcrypt on email addresses is pants-on-head retarded. Please stop cargo-culting cryptography.
How do you propose to look up accounts by email address if they use a salted hash? You would have to bcrypt the email against every row in the database until you found the correct one. If you use a username to do the lookup instead, why store the email address at all? You can't use it for anything.
- girvo 12y agoThis, so much this. I'm super confused as to why we are having a discussion about hashing emails?
- hyperpape 12y agoYou're right and wrong. Right because it's a crazy idea. Wrong, because it's the logical conclusion of the belief that emails must be treated with as much care as passwords. If you really think that, then you need to encrypt them, and therefore you have to give up the ability to look up user accounts by email address. All you could do is verify that a user-submitted email is associated with a user-submitted account. That's where you end up when you have that sort of paranoia about email addresses. But that conclusion is, like you said, absurd, and I never should've implied otherwise. I wasn't thinking when I wrote it.