You might not need to store plaintext email addresses

Re:You might not need to store plaintext email addresses by wccrawford on Monday November 02, 2020 @07:18AM (#24967283)

I think the others are missing the fact that if you use the same salt for every row, it's less secure. So you'll be storing the email more securely, but still not as securely as you should be storing the password.

To do it any more securely would require pulling up every single record for its salt, and hashing the login with that salt and checking it. It's virtually impossible at any real scale.

[ Parent | on HN ]

Re:You might not need to store plaintext email addresses by raziel2p on Monday November 02, 2020 @10:57AM (#24969473)

Hah, when I wrote my comment above I didn't even consider the possibility of using the same salt everywhere.

I suppose the goal here is privacy, not information security, so it's okay.

[ Parent | on HN ]

Re:You might not need to store plaintext email addresses by benlivengood on Monday November 02, 2020 @11:50AM (#24970118)

It's pretty scalable. 10 billion email addresses times 16+32+4 bytes of salt, SHA512/256, and ID is 520GB of RAM; available in a single (big) machine and searchable in under a second with a few cores.

Shard it into multiple machines for higher QPS.

[ Parent | on HN ]