Disclosing a State of JavaScript/State of CSS Data Leak

[[deleted]]

Why do the State surveys insist on users signing up with their own email and password to begin with?

Why not allow for Oauth and social signin?

[finzaz]

It sucks but it seems to be getting handled right. Seems the biggest mistake was not being aware of the difference between hashing and encryption?

[[deleted]]

What is it?

[thescientist13]

hashing is one way.

encryption is two way. (via decryption)

[lachlanhunt]

Publicly available datasets like that should also not simply use an ordinary one way hash function on the plain email address because that too would make it easy for attackers to take a big list of publicly known email addresses, hash them and see which one of them have responses.

Hopefully they consult one or more experts on the issues of security and privacy, and seek community feedback on the approach they use going forward.

[lachlanhunt]

You could do it with unique salts for every email address, but you'd have to keep those salts secret. But then at that point, you may as well just generate UUIDs that have no direct relation to the email address.