News for hackers. Stuff that matters.
Re:Immutable Data by vbezhenar on Monday June 26, 2023 @06:40AM (#36478007)
While it's better than storing emails in clear-text, nobody uses [email protected]. Brute-forcing emails is going to be pretty effective. And if you have another e-mail database (which are plenty available in the open wild), I bet that success rate will be huge.

I like Apple's approach to generating random throwaway emails.

Re:Immutable Data by kaba0 on Monday June 26, 2023 @06:49AM (#36478057)
You don’t have to use the same salt for each email, right? You can hash each email with a separate, random salt and “brute force” upon password recovery. That way while individual emails can still be restored, you can’t easily get a database of emails to mass-spam, which is the point (emails are not really private completely, anyway).

I also like apple’s method, but it is not either-or.