Timeline for Can there be a way to find a user given his email hash?
Current License: CC BY-SA 2.5
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 12, 2010 at 13:41 | comment | added | Sky Sanders | @steffen - what I am going to do with it is improve the UX on my stack exchange related sites, allowing a user to login to my site with open id and i will already have a good start on presenting their data. And I just need one matching hash to get an associationid which gives me all of their other accounts regardless of the hash. | |
| Aug 12, 2010 at 13:38 | comment | added | Sky Sanders | @steffen - reducing attack surface goes a long way to reducing attacks/abuse. If there were an actual security or privacy issue then security through obscurity would be a negligent choice. In this case, where the characteristics of the 'abuse' are innocuous, not providing a route that returns a user for a hash seems appropriate. Using soapi, I can pull every user in stackiverse with rep > 100 in less than 5 minutes. It takes about an hour to get EVERY user. Then I don't need a method. But what am I going to do with the info that is dangerous or violating? | |
| Aug 12, 2010 at 13:12 | comment | added | Steffen Opel | Hmmh, haven't thought that through really, but isn't not exposing a method anything but script kiddie protection, i.e. anybody inclined to have that method can build one by himself as per your instructions (and very productive enabling work via SOAPI ;) - or am I missing something here? Does this sort of kinda low first line of defense really help in reducing abuse? Just a short comment/thought, I'm well aware that discussing privacy/security thoroughly would deserve a dedicated Stack Exchange site in principal ... | |
| Aug 11, 2010 at 22:41 | history | answered | Sky Sanders | CC BY-SA 2.5 |