<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>On Aug 28, 2014, at 3:08 PM, yan <<a href="mailto:yan@mit.edu">yan@mit.edu</a>> wrote:</div><br><blockquote type="cite">I guess I don't understand why hashing is necessarily "trivially<br>invertible" here. If the threat is large precomputed rainbow tables of<br>potential email addresses, you could have the email provider salt the<br>hashes before submitting them to the log; or probably easier, have a<br>unique "pepper" per email provider that gets rotated on some interval [1].</blockquote><div><br></div>The domain part of the email is likely known, which leaves the user part, which is trivially inverted on modern hardware without any rainbow tables involved (simply brute force).<div><br></div><div>The addition of sale and pepper would therefore be a requirement (at bare minimum).</div><div><br></div><div>Still, even salt and pepper is not enough (to protect passwords) [1], so if you really want to protect them, bcrypt/scrypt should be used instead. Heh, just remembered your twitter name, so I'm probably preaching to the choir.</div><div><br></div><div>[1] <a href="https://news.ycombinator.com/item?id=8088299">https://news.ycombinator.com/item?id=8088299</a></div><div><div><br></div><div>Kind regards,</div><div>Greg<br><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br></div></div></body></html>