See issue #271 for additonal details.
sha1 is used on BSSID without applying salting, thus correlation is possible with sources:
collections of bssids (just hash them, check if it's matched to what stored on the device)
collections of bssids which use the same algorithm (such as another app who use sha1(bssids) and leaks it to server-side)
Thus its better to salt them with public prefix such as:
sha256('hamagenapp' + bssid)
which will avoid the second possible correlation (as only hamagen app will use hamagenapp prefix), and increase the cost required for building rainbowtable (it will apply only for hamagen app)
Depending on the intended usage of this feature it might be possible to add in addition a unique prefix as well.
See issue #271 for additonal details. sha1 is used on BSSID without applying salting, thus correlation is possible with sources:
sha1(bssids)
and leaks it to server-side)Thus its better to salt them with public prefix such as:
sha256('hamagenapp' + bssid)
which will avoid the second possible correlation (as only hamagen app will usehamagenapp
prefix), and increase the cost required for building rainbowtable (it will apply only for hamagen app)Depending on the intended usage of this feature it might be possible to add in addition a unique prefix as well.