Page MenuHomePhabricator

Add img_sha256, related columns with SHA-256 hash of file
Open, LowPublic

Description

Image table's img_sha1 file is used to look for duplicate files at upload time. While known SHA-1 attacks can't be used to create a duplicate of an existing file, they can be used to create pairs or sets of files which will cause confusion, leading to recommendation to use SHA-256 instead.

Recommend:

  • add img_sha256 and related fields
  • populate hashes of old entries
  • adjust suitable internal and external APIs to take SHA-256 hashes as well as SHA-1 hashes

Event Timeline

MarkTraceur moved this task from Untriaged to Triaged on the Multimedia board.

Btw. I figured that this might be resource intensive to calculate for all files, but I realized that the sha256’s are already in swift/mediabackups. So should be relatively easy to backfill one day.

Something we could also consider is to have the api, bridge this information from swift.