Open FlorentCLMichel opened 2 years ago
I think probably it should be something like Hash("yourname" XOR "theirname") but either way it is still vulnerable to a dictionary attack if you knew either "yourname" or "theirname" as a dictionary could be easily compiled from their social media account.
First, thanks a lot for making this website and the code open-source! It's a very fun way to illustrate one of the applications of hash functions!
I have a small suggestion to further reduce the amount of information that can be extracted from the hash. If I am correct, the hash is calculated from the crush's name only. So, if two people, say Archibald and Bob, have the same crush, say Charlene Randomfamilyname, both will get the same hash
Hash("Charlene Randomfamilyname")
. Someone who can see the two hashes thus knows that Archibald and Bob have the same crush. (Or, at least, that the names of their crushes have the same hash, which, if the probability of collision is small enough, means they have the same name with very high probability.)One possible solution would be to hash a combination of the user's name and that of the crush. In this example, the two hashes would be
Hash("Archibald Charlene Randomfamilyname")
andHash("Bob Charlene Randomfamilyname")
. Anyone who does not know the name of Archibald's nor Bob's crush would then be able to tell whether they have the same crush without a brute-force attack (assuming, of course, that the hash function and its implementation are secure).