← Timeline
Avatar placeholder
tigra
(updated )

Reply to the post by @kochavak:

Interesting that wiki speaks about hashing but I can't see how it can be used to statistical data.As the users do want to have some, even generalized, picture.

Looks like if hashing based anonymization is used, the hashed field can't be used to generate useful statistics.
The use case for that described there is a secure way to figure out if your password is compromised in known breaches.
You can have a database of passwords that you know were stolen. Your goal is to allow people check if their password if in that list. However, the person does not want to disclose their password when checking it.
So, it is possible to hash it, truncate the hash so that there is at least k-1 collisions (passwords associated with same truncated hash). Then, as I understand, the password itself is not submitted, the truncated hash does. The service then returns if some of passwords generating same truncated hash were compromised. This way, user don't disclose the password to the password checking service (it is still a lot of work to do a bruteforce attack and guess the real password), while user gets information about the password being compromised or not with high probability..
https://en.wikipedia.org/wiki/Have_I_Been_Pwned%3F

👍1
To react or comment  View in Web Client