Hacker News Reader

Comment by jedsmith | Hacker News Reader

What is the point of including the domain tied to the address? It just decreases the anonymity of what you've hashed, and actually does a disservice. There are corporate domains in there and the namespace of what to search for becomes a lot smaller.

In addition, my domain is my name. I saw many others in the file that this was the case for. It's not a big leap to compute my e-mail from 'jedsmith.org', and I'm sure it isn't for those guys either. You're leaking data with this view.

Here's a version that is far more anonymous (and easier, I think): http://undertow.jedsmith.org/gawker/

View on HN

Why even bother hashing the email addresses when the entire dump can be downloaded with bit torrent.

Because I'd prefer not to help distribute the leaked information? If you want the information, nothing stopping you from getting it, true. However, me throwing up an entire list of e-mails just adds to the problem.

I like it.

OS X users, if you are paranoid about using online tools for the SHA-256 hashing, you can do this from the command line with sha256deep.

Via Homebrew it'd go like this (replace the 1st step with whatever package manager you like):

$ brew install md5deep

$ echo -n my@email | sha256deep

d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2

The hash is md5 not sha

He's referring to using mine.

Also

python

>import hashlib

>hashlib.sha256("you@yourdomain.com").hexdigest()

…or without installing anything:

    $ echo -n 'my@email' |openssl dgst -sha256
    d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2

Or, with the cryptically named 'md5'...

    echo -n 'my@email' | md5

md5 != sha256

   $ echo -n 'my@email' | shasum -a 256
   d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2  -

Ah - true - we're talking about different things though (which is my fault to start with, but I see confusion in others too).

MD5 is what's used in the linked spreadsheet's email address fields, which is what I thought we were talking about. SHA-256 is used in jedsmith's lists.

Any one with ill intent will have already downloaded the full unanonymous file.

I found it useful because I use site-specific email addresses (as in username+domain@example.com). I didn't know if I had a gawker login, so I searched for my domain. If I hadn't found it, I could've saved myself digging through my saved email.

Reply on news.ycombinator.com