3 ms·
That is true in principle and I didn't take that into account when I thought about it. Though it would still be possible, in theory, to use a hash function that
by mckirk 6y ago
That is true in principle and I didn't take that into account when I thought about it. Though it would still be possible, in theory, to use a hash function that is cheap enough so it's feasible to hash all the leaked numbers once, but expensive enough that it would take a long time to brute-force the whole number space.
Since there's about 32 million leaked US numbers, but there potentially exist up to 10 billion, any hash function that would take a day to process the leak would still require over 300 days to bruteforce the whole space.
Granted, any number in the leaked set could still be trivially reversed when submitted -- but those were known already anyway, they are just associated with more metadata now.
- dotancohen 6y agoMany methods could be used to reduce the search space, such as not allowing the seventh-from-last and tenth-from-last digit to equal 0. Now I've reduced the search space by two orders of magnitude, so those 300 days just became 3 days.
- mckirk 6y agoTo be honest, I don't really know the rules governing US phone numbers and just did a cursory google search, which came up with the simple answer of "10 billion". That is very likely quite an overestimation. But if I'm not mistaken, the limitations you describe only reduce the search space by 19% (since it's two 90%-steps).
- dotancohen 6y ago100 * 0.1 = 10 // First 90% Reduction 10 * 0.1 = 1 // Second 90% Reduction
- mckirk 6y agoNot allowing a single digit to be 0 is a 10% reduction though, is it not?
- dotancohen 6y agoOh, you're right! Thank you.
- mckirk 6y agoNo worries :) I checked the math so many times because I was starting to suspect my mind was glitching, lol.