Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm pretty sure the parent meant "precompute" (e.g. a rainbow table), not "brute force".


Again: you're right in the case of SHA1, but rainbow tables don't apply to bcrypt because of the varying work factor, also you can use a different salt for each person.

Crypto is actually really cool these days, there's pretty much a solution to every weakness :)


So your solution to providing a "secure" way to compare phone numbers, etc, between users is to make the hashes non-comparable? Remember, the goal is to make it so two people can come up with the same hash in order to "find" each other.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: