5 ms·
I'm working on exactly that, using k-anonymity too. I expect to release my tool within 24h
by arnaudsm 6y ago
I'm working on exactly that, using k-anonymity too. I expect to release my tool within 24h
- LilBytes 6y agoLooking forward to the Show HN. Keep us posted.
- hugoromano 6y agowhere should we go for your tool?
- arnaudsm 6y agoIt's now live on https://fbleak.info/ https://fbleak.info/, and it's open-source !
- sagarm 6y agoHow could a tool that checks for a specific phone number be k-anonymous?
- Godel_unicode 6y agoIt can't. Or at least, not while remaining useful for the haveibeenpwned use case. It's also an interesting choice for a search tool for a quasi-public dataset.
- arnaudsm 6y agoBy using partial sha256 hashes + padding, and doing the checking locally
- GoblinSlayer 6y agoIn the same way as for passwords.
- nikisweeting 6y agoNah because you can iterate through all phone numbers pretty quickly.
- GoblinSlayer 6y agoIterating through passwords is not slower. And in practice there's no need to iterate, you just download the leak and see phone numbers there.
- nikisweeting 6y agoAgreed, just saying it's especially trivial for phone numbers.
- fX0rObfoMN4 6y agoPhone numbers are only 10 digits. That is only 10 billion combinations. For SHA1 which pwned passwords uses that it should only take a couple seconds on a decent system. Even with SHA256 it could be done in like a minute.
- 1vuio0pswjnm7 6y agoThis is a easy way to collect phone numbers of concerned Facebook users. Facebook then allows the person collecting phone numbers to search for the name of the user associated with a phone number (or email address). https://mbasic.facebook.com/login/identify/?ctx=recover https://mbasic.facebook.com/login/identify/?ctx=recover
- technion 6y agoI believe this has been limited more recently. I just put my number in there and it just says that I can click OK to text myself a password reset, but didn't leak any details on screen.