3 ms·
First off, "someone can lift your phone number via you merely having Bluetooth running" is entirely not true of this information leak. The scope of this issue
by bri3d 7y ago
First off, "someone can lift your phone number via you merely having Bluetooth running" is entirely not true of this information leak.
The scope of this issue is that an unsalted SHA256 of your phone number is broadcast when you open the Share dialog with AirDrop and Bluetooth active. Your phone number is broadcast to determine whether the sending device is in the receiving device's contacts list.
The feature that causes this information leak (AirDrop) has no equivalent on stock Android, but hundreds of horrifyingly insecure apps exist to replicate it.
Google are introducing a similar feature (Fast Share) soon and we will see how it fares security wise.
This is an interesting cryptography question: how do you allow two mutually untrusted client devices to determine that they share a common secret, without disclosing the secret? And for bonus points, how do you allow this to happen without two-way communication?
- nemosaltat 7y ago>This is an interesting cryptography question Is that a solved problem?
- mehrdadn 7y agoIt sounds impossible for very-low-entropy secrets. Like just imagine if the secret is 1 bit. Anyone can pretend they have that 1 bit (since they can just try both possibilities), which would let them determine that's the same secret the other person has. The only solution would seem to be to stretch the entropy and make a brute-force enumeration slow.
- Thorrez 7y ago> how do you allow two mutually untrusted client devices to determine that they share a common secret, without disclosing the secret? Use a PAKE. Although I think they all require two-way communication. https://en.wikipedia.org/wiki/Password-authenticated_key_agreement https://en.wikipedia.org/wiki/Password-authenticated_key_agr...