Let's assume there is a database containing names and each name is hashed and the clear-text is deleted.
If an attacker were to steal this database, would he/she be able to get the list of names?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
A hash function is one-way in the following sense: given the output, the fastest method to find a matching input is to try possible inputs until a match is found. You cannot get more one-way than that. However, this does not mean that hashing names and hoping for a match does not work; in fact, people names are depressingly not varied enough, it is easy to enumerate and hash them all. Since a hash function is public (no secret element) and deterministic (if you hash twice the same data, you get twice the same output), brute force on names will work. A PC with a medium-sized GPU can hash billions of strings per second.
The same problem occurs with passwords, which are limited by the average imagination of human users. When we hash passwords, we must do it with care. The same would apply to names, possibly even more so.
Names don't have enough entropy, and as Thomas Pornin said, a GPU is fast enough to let you bruteforce your way through billions of names until you find matching hashes relatively quickly.
If the database has other longer fields that happen to have a lot of entropy in them, concatenating them together and hashing the sum that with the names will increase the entropy; the longer the better chance you have of reaching a length long enough that an attacker has to go to reasonable lengths to get matches, provided you use a sufficiently strong hashing algorithm.
What my last paragraph explains is essentially salting.
The attacker is likely to thus have the salts; this in itself makes things difficult for rainbow-tables style attacks but doesn't mean attacker can't still bruteforce concatenating strings onto the salt - particularly by doing common names first they're likely not to have to try too many.
This write-up is quite excellent: https://crackstation.net/hashing-security.htm