Hacker News Reader

Doing an extra round of hashing wouldn't do anything. If they were different before, now they might be the same. If the hashing algorithm is worth its salt (pun intended) then the original hash will be just as random as the hash of the hash, providing nothing of value.

View on HN

I think it might work if you display both the hash and the image, and ask the user to compare both.

If the hashes are very different, it doesn't matter that the images are similar (assuming the user indeed verifies both).

If the hashes are similar, another round of hashing before producing the image, might make the images very different.

But maybe I misunderstood?

The problem is that an attacker can churn out public keys until they end up with a hash that's very similar.

Picking a random number and doing a keyed hash of both inputs, then comparing those, would bring out small differences in a way the attacker cannot control.

Reply on news.ycombinator.com