Tsunami Hazard Zone - In case of earthquake, go to high ground or inlandLet's talk about Anouck. She is creating her FOAF document, but she receives tons of spam every day, and wouldn't like her new FOAF file to be one more way for spammers to get her mail address. Therefore she uses foaf:sha1sum in order to protect her privacy, but also to be identifyable within the Semantic Web. Her mail address is mailto:anouck@example.org, and its SHA-1 hash is 11a61224bc19649d4f3f2dec2406c88eff10c19e. Her FOAF document basically looks like this:

<foaf:Person>
 <foaf:name>Anouck</foaf:name>
 <foaf:mbox_sha1sum>11a61224bc19649d4f3f2dec2406c88eff10c19e</foaf:mbox_sha1sum>
</foaf:Person>

But she hears about SHA-1 being broken. The FOAF community decide to create foaf:mbox_sha256sum, and Anouck immediately replaces her old SHA-1 checksum by the brand new SHA-256 checksum:

<foaf:Person>
 <foaf:name>Anouck</foaf:name>
 <foaf:mbox_sha256sum>a4b57c86f7efd0f7322ffe906c4e323b621f12df87006699b0728081ca092436</foaf:sha256sum>
</foaf:Person>

And she thinks everything is perfect. Her mail address is perfectly protected from the spammers. Actually, it is, SHA-256 being - at the moment - resistant to the attacks. But what about archives ? What about old copies of her FOAF file, containing the same mail address, but hashed using SHA-1? There must tons of way to grab it! Google cache, Semantic Web crawlers, etc.

If the "go to high ground" technique is a very good way to save your life in case of a tsunami, it isn't is the case of protecting your mail address from spammers, just because of the archives... I wonder if there is a way to overcome this problem.

[Side note] The tsunami sign comes from a PDF by the Departement of Geology of the State of Oregon, USA.

[Edit] You can try to generate SHA-256 checksums with this page I created, based on a class I found on the Net. Remember that foaf:mbox_sha256sum does not exist yet!