libravatar-fans team mailing list archive

[Tristan Le Guern <tleguern@xxxxxxxxxxx>]

On 3/12/19 12:59 PM, clime wrote:
> I am missing the point encrypting the hash. I could understand it for
> md5, which is crackable nowdays but not quite for sha256. That hash
> should be non-reversible in practical terms and then we can always just
> jump to sha512 in a few years when hardware is stronger

SHA256 is still susceptible to rainbow tables attack so in theory a
dedicated spammer could still harvest libravatar users' hashes for his
nefarious purpose and use them to validate email addresses. This issue
has been raised since Gravatar's birth.

Oliver proposes a mechanism to solve this issue but with a clear
drawback: in it's current form it breaks federation.

Attachment: signature.asc
Description: OpenPGP digital signature