4 ms·
I'm not an expert, so bear with me. Could this be thwarted by, say, having Signal add a random salt to every registering number and then advertising the hash o
by abovemypaygrade 9y ago
I'm not an expert, so bear with me. Could this be thwarted by, say, having Signal add a random salt to every registering number and then advertising the hash of (number)+(random salt) as the final contact, invisible to the end user? Or would that involve Signal maintaining too much information on their users? If that's the case, I could see that being a problem.
- azdle 9y agoThe problem with salting the hashes is that they then become useless for contact discovery. The only way I can think of to make it work would require sharing the salt with people trying to find you, but then at that point you just share a real user identifier and short-circuit the whole process happening here.
- abovemypaygrade 9y agoThe way I was initially picturing it would involve Signal keeping track of the salt they assigned to the contact number, with that specific salt maybe 'expiring' after a certain number of days (to get rid of salts where someone registered with Signal, didn't like it, and never registered again). After thinking about it some more, I realized that this would probably lead OWS to collecting big lists of registered users and their contact patterns, which goes against their policy of trying to retain as little data as possible.