You might not need to store plaintext email addresses
blog.klungo.no
You might not need to store plaintext email addresses
1–10 of 181 posts
Re: You might not need to store plaintext email addresses
#2To support: Hey, I closed my Facebook account and would like you to delete my data for me?
Oh...
Re: You might not need to store plaintext email addresses
#3It's a good idea to protect user privacy. One drawback I can think of storing a hashed email is - What if the user forgets the username / email id and wants to know it? (This is a common use case). In such a case you have to collect additional unique data to help the user gain access to their account, but that defeats the original purpose - to protect user privacy.
Re: You might not need to store plaintext email addresses
#4To support: Hey, I closed my Facebook account and would like you to delete my data for me? Oh...
They could simply check whether the hash they stored corresponds to your email address.
Re: You might not need to store plaintext email addresses
#5Good points. Though given how many emails have been leaked already, not sure sha256 with fixed salt achieves much. One can build a rainbow table with that salt fairly quickly. You might as well use bcrypt, scrypt and co.
Re: You might not need to store plaintext email addresses
#6To support: Hey, I closed my Facebook account and would like you to delete my data for me? Oh...
You're right that could be an issue, but hopefully anyone who registered via Facebook will take care to add an email/password to their account and disconnect Facebook before they delete their Facebook account.
Re: You might not need to store plaintext email addresses
#7It's a good idea to protect user privacy. One drawback I can think of storing a hashed email is - What if the user forgets the username / email id and wants to know it? (This is a common use case). In such a case you have to collect additional unique data to help the user gain access to their account, but that defeats the original purpose - to protect user privacy.
You could use a combination of TOTP/google/facebook or some other side channel verification and use that to allow unlimited tries for a certain period of time to allow for more guesses? I'm thinking that for the most part people generally have/keep I do wonder though -- if the hash secret gets out then I think we're right back to where we started... it would be easy to cross-reference leaded email DBs with the dumped DB and work backwards. I'm now a bit less sure this does much for use privacy against an even slightly motivated opponent (one who would almost certainly have access to at least one dump of previously-exposed emails)...
Re: You might not need to store plaintext email addresses
#8To support: Hey, I closed my Facebook account and would like you to delete my data for me? Oh...
They could simply check whether the hash they stored corresponds to your email address.
Good catch, I missed in the conclusion that they suggested hashing the email if necessary (earlier in the article they mentioned only hashing the identifier).
Re: You might not need to store plaintext email addresses
#9To support: Hey, I closed my Facebook account and would like you to delete my data for me? Oh...
They could simply check whether the hash they stored corresponds to your email address.
In this case they will have to provide their facebook id which they probably did not store and have a means of authentication which they deleted.
Re: You might not need to store plaintext email addresses
#10Maybe this is not important in your user-case, but what if you have a database breach and you have to warm your users?