4 ms·
> the server having the hash of your phone number isn't adding too much data to them. Wait how big is the hash of the phone number? If it's enough bits (e.g.,
by kosievdmerwe 7y ago
> the server having the hash of your phone number isn't adding too much data to them.
Wait how big is the hash of the phone number?
If it's enough bits (e.g., a full sha hash) then it's not that secure to hash at all. 10^10 or even 10^11 is just 10 or 100 billion. I can easily try all phone numbers until I find the one that matches the hash.
It maybe protects against attacks against lots of people, but it really doesn't protect an individual.
- tialaramex 7y agoIt's 10 bytes, so 80-bits. You are correct that using a hash does not protect an individual from other users discovering that they can contact them with Signal, which is to be expected because that's the purpose of this feature. If you suspect that Bob, with phone number +15555551234 has Signal installed, you can verify that by... typing Bob's phone number into your contacts list and installing Signal so you can send messages to Bob.
- ZephyrP 7y agoFor the purposes of entropy, you need only consider 10 valid choices for each symbol of a phone number so it's closer to 33.21 bits (10 * (log(10) / log(2))) and smaller still when discarding impossible area, trunk & subscriber numbers.
- gpvos 7y agoAnd then a bit larger again when including foreign phone numbers.
- kosievdmerwe 7y agoSo given than 80 bits is much bigger than 30-40 bits, if I know someone's hash I can very easily narrow down their phone number to one or sometimes two candidates.
- tialaramex 7y agoNo, I'm describing the truncated hash. Signal truncates SHA1 to 10 bytes of output. No matter if your phone number is six digits or sixteen, Signal uses 10 bytes (80 bits) of the hash.
- maqp 7y agoThe point isn't hashes anonymize you, the point is you're already leaking IP in most cases, so phone number doesn't really reveal anything additional.
- kosievdmerwe 7y agoI'd much rather leak an ip than a phone number.
- maqp 7y agoUnder what threat model?
- kosievdmerwe 7y agoPretty much anything I can think of. If someone get's my phone number they can bug me or identify me much more concretely/completely. What threat model has a IP be worse to leak than a phone number?