5 ms·
How could a tool that checks for a specific phone number be k-anonymous?
by sagarm 6y ago
How could a tool that checks for a specific phone number be k-anonymous?
- Godel_unicode 6y agoIt can't. Or at least, not while remaining useful for the haveibeenpwned use case. It's also an interesting choice for a search tool for a quasi-public dataset.
- arnaudsm 6y agoBy using partial sha256 hashes + padding, and doing the checking locally
- GoblinSlayer 6y agoIn the same way as for passwords.
- nikisweeting 6y agoNah because you can iterate through all phone numbers pretty quickly.
- GoblinSlayer 6y agoIterating through passwords is not slower. And in practice there's no need to iterate, you just download the leak and see phone numbers there.
- nikisweeting 6y agoAgreed, just saying it's especially trivial for phone numbers.
- fX0rObfoMN4 6y agoPhone numbers are only 10 digits. That is only 10 billion combinations. For SHA1 which pwned passwords uses that it should only take a couple seconds on a decent system. Even with SHA256 it could be done in like a minute.