The masqueraded domain is logged as a hash so a log can be shared
without naming it. That did not hold: the name is short and drawn
from a small set of plausible ones, so eight bytes of SHA-256 fall
to a wordlist immediately - www.google.com came back out of a real
log this way in under a second, from 12900 candidates, while
working out which relay a user was on.
The salt is sixteen random bytes drawn once per run and hashed
before the domain, so no prefix of the digest depends on the domain
alone. What the field is actually for still works: inside one log,
connections carrying the same name still share a hash. Across two
logs they no longer line up, which is the right trade for a field
whose whole purpose was to not name the domain.
Both report builders now go through one helper; neither hashes the
domain directly. Guarded, including that the salt is drawn once
rather than per call - per call would leave the field useless for
matching within a log.
b4d1418e81