You might not need to store (plaintext) emails

Re:You might not need to store (plaintext) emails by 3np on Monday November 02, 2020 @07:26AM (#24967366)

Sure, there's no silver bullet and the author never claimed it's perfectly secure (is there such a thing?). But this is definitely an improvement - it clearly limits exposure.

To successfully do a brute-force the attacker would also need the salt, which means that the database by itself will not yield any e-mail addresses.

[ Parent | on HN ]

Re:You might not need to store (plaintext) emails by yobert on Monday November 02, 2020 @02:40PM (#24972197)

Another benefit isn't a security one, but a user-friendliness one: This forces all emails to your users to be initiated by them in some way, which limits future business decisions about sending email by automated processes. Good for users, but may be bad for business.

[ Parent | on HN ]

Re:You might not need to store (plaintext) emails by sroussey on Monday November 02, 2020 @07:47PM (#24975170)

Also, possibly illegal. If you have a data breach, you must contact your users.

Probably better to use encryption with public / private keys.

[ Parent | on HN ]