Messaging done right. No phone number. No Email. No sign up required

Re:Messaging done right. No phone number. No Email. No sign ... by ralfk on Thursday November 24, 2016 @06:00AM (#13029676)

Informations we store [...] Hashed value of your email

okay, so you can easily make a rainbow-table and thus your users are not anonymous anymore + if someone has your database and want to know if [email protected] has an account one can easily find that out, even without the need to bruteforce all emails. Btw. in this case it makes absolutely no difference if you or the client computes the hash ;)

[ Parent | on HN ]

Re:Messaging done right. No phone number. No Email. No sign ... by stubish on Thursday November 24, 2016 @06:34AM (#13029787)

You are assuming a lack of salt when the client hashes the password.

[ Parent | on HN ]

Re:Messaging done right. No phone number. No Email. No sign ... by ralfk on Thursday November 24, 2016 @08:14AM (#13030140)

You are right, in this case he can use a salt for the hash - my second point is still valid though, but I guess that is fundamentally so if you want to use passwords

[ Parent | on HN ]

Re:Messaging done right. No phone number. No Email. No sign ... by ahomeDesk on Thursday November 24, 2016 @12:17PM (#13031385)

While there is no 100% secure system, we are working very very hard to make our system as much secure as possible.

[ Parent | on HN ]