3 ms·
As far as I can tell they cannot discard the salt if they want to be able to tell if you already have a 'humanID'. Without the salt, you cannot tell if the phon
by extrapickles 5y ago
As far as I can tell they cannot discard the salt if they want to be able to tell if you already have a 'humanID'. Without the salt, you cannot tell if the phone number already has an account without having to brute force the salt.
If they were serious about this, they should at least use scrypt or some other modern password hashing technique as salted sha512 can be computed too quickly on modern hardware.