Hacker News Reader

The point is that the hash needs to be same for all users, so salts are out of question and custom hashing schemes does not help you as the assumed installed base is significant.

View on HN

See my sibling comment about the salt.

As long as hashes are computed client-side, I don't see why the size of the installed base matters?

Size of installed base matters because it is perfect argument for why using some weird custom hashing does not solve anything as all clients have to use the same algorithm and when your network is interesting target it is also big enough to account for whatever effort is required to break the hash by brute force or generate useful rainbow tables.

Reply on news.ycombinator.com