0

I have a wordpress based website, a very important thing is that no one should get to know the email addresses of the people who will admin.

I will make the whole website private but I am still thinking what else could I do. So I got the idea I could hash the emails in the db.

Has anyone done that?

What are the functionalities that need email address? As far as I know it is only needed when creating the user, because the password is sent to the user, and then it is needed at a password reset. So I would need to modify these so that it decrypts the email first.

Is there anything else? Do you think it's useless as a security measure?

Improve this question
1
  • 1
    Just an alternative non-WordPress solution: You could setup postboxes, with general user names and from there, redirect the mails to the sensitive email addresses.
    – birgire
    Commented Sep 30, 2015 at 14:11

1 Answer 1

Reset to default
0

Hashing is a one-way function, meaning you can't get back an original string from a hash value.

You could use the PHP function mcrypt_encrypt to "encrypt" the email address and mcrypt_decrypt to convert it back.

If you went that route, you could hook into password_reset to decode the email address before the password reset is sent, and then hook into password_reset_after to encode it again after.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.