Weak Hashing Schemes

• Primarily abused in verification URLs

• Don't just hash information known to the user

• Algorithmic AND text secret

• • base64enc(md5($user+”secret”) + \ sha256($email+”othersecret”))