ckan/ckan — pull request #1657 by nigelbabu (2014-04-22 12:00:06+00:00)
Title: [wip] API exposes non-salted MD5 hashes of email addresses by default

From the CKAN API (e.g. http://demo.ckan.org/api/3/action/user_list), unregistered visitors can get MD5 hashes of email addresses for all users. As these hashes are also not salted, one can use rainbow tables to revert the hashes into email addresses. There are many precomputed rainbow tables and even search engines available that can be used for this.

Is there any need for the API to expose the email hash? Furthermore, maybe it would be better to use similar means as with a password. I know that in general, an email address is not really a secret, but now users have no choice whether their email address can be obtained.

Relates to #1530