undefined | Better HN

0 pointsdonatj3y ago0 comments

We moved basically everything but username into an entirely different db, went so far as to hash the username column so we don’t even know what’s it is until you log in.

0 comments

3np3y ago

> hash the username column

Is this giving you any real security benefit? (I'd assume the usernames are indexed elsewhere and that it's a reasonable assumption that whoever gains access to this hashed data has access to the username list as well, making a lookup trivial - or are these not safe assumptions?)

couchand3y ago

Not GP, but one architecture where there would be a difference is there's a distinct identity provider, responsible solely for exchanging the user's long-lived username/password credentials for a short-lived ticket.

bigDinosaur3y ago

I imagine the process going a bit like https://youtu.be/y8OnoxKotPQ

1 more reply

donatjOP3y ago

It's a PII covering our butts thing more than anything. Wanting to absolutely minimize what we know about our users.

j / k navigate · click thread line to collapse