3 ms·
> It should be possible for privacy-concerned users to provide another form of identifier (e.g. a username or email address, as is the standard for social netwo
by bigiain 6y ago
> It should be possible for privacy-concerned users to provide another form of identifier (e.g. a username or email address, as is the standard for social networks) instead of their phone number.
This expands the search space, without actually solving the problem, I think. The problem exposed by the study shows that phone numbers have a small enough search space to be readily enumerable. Adding email addresses and/or usernames just means the same attacker would need to move to well understood JackTheRipper/Hashcat style dictionary attacks.
I think to thwart these types of attacks, every user identifier needs to be something very like a GUID (and a proper long one like 128 bits and a totally random one, not a hash of their phone number or email address).
- dbrgn 6y agoYep, my point was that if the phone/email thing is entirely optional, then users can choose not to link any non-random identifier at all. You are right that e-mail space is also quite small (albeit not as small as phone numbers), especially considering that a huge part of users will have a @gmail.com address.
- bigiain 6y agoIf you attack email addresses as a dictionary attack instead of brute forcing the entire possible email address space, they’re actually a smaller search space. The paper claims 53 trillion possible (global) phone numbers, and 700 billion mobile numbers. Haveibeenpwned has just recently passed 10 billion email addresses- Troy probably doesn’t have _every_ valid email in existence (yet), but I’d be surprised if it was as low as 1 in 70 (or 1 in 5,300). At least cutting phone numbers down to just a specific country works better in eliminating in needed searches than for email (all those @gmail.com @outlook.com and to a lesser extent @company.com addresses aren’t country specific).