4 ms·
Agreed. It is weird that they just hash the phone number and don't salt it with something else. Even just appleid+phonenumber would be huge and prevent pre-atta
by snarf21 7y ago
Agreed. It is weird that they just hash the phone number and don't salt it with something else. Even just appleid+phonenumber would be huge and prevent pre-attacks.
- aidenn0 7y agoIt's what about an hour to calculate the SHA of all 10 digit numbers in the US?
- bristleworm 7y agoI was curious: my Laptop needed 18 minutes.
- aidenn0 7y agohaha, I checked my source and I had the units wrong so I was off by a factor of 1000. Looks like 8x GTX1080s can do almost 3 billion SHA256 hashes per second, so you could just brute force these with no table with the right hardware.
- Operyl 7y agoThen the problem is: “You’re leaking your Apple ID to everyone in your contact list!” or more, depending on how exactly they’d plan to distribute Apple IDs to everybody else. The hash of the phone number thing is to provide the “contacts only” airdrop thing.
- snarf21 7y agoI'm missing what you are saying, sorry. If I know your email already, nothing is getting leaked. If I don't know your apple ID email, I have to brute force all combinations of email concatenated with your phone number to figure it out. If a stranger doesn't know either piece, they'd have to pre-image the entire space which is nigh impossible (all phone #s X all email addresses)
- wool_gather 7y agoYou're right, but they probably have/want to cover the case where you've given someone just your phone number (or just your email).
- Operyl 7y agoIt’s convenient to just have a phone number be the piece both sides know. It’s not as magical if you need to also give your AppleID to every single contact manually, and if you have some sort of Phone Number to AppleID lookup service it’d be abused just as badly is what I’m saying here.