3 ms·
> I'd be surprised if the attack was fast enough to just gulp down all your contacts in the couple of seconds most people have their share sheets open. No, wit
by grupthink 5y ago
> I'd be surprised if the attack was fast enough to just gulp down all your contacts in the couple of seconds most people have their share sheets open.
No, with the share sheet open, the attacker can simply record the hashes of phone numbers that are being broadcasted. And then crack the hashes off-line at any time, which is easy since there are at max 999-999-9999 hashes.
- zimpenfish 5y ago> since there are at max 999-999-9999 hashes Assuming that's meant to represent 10 digits, it's not sufficient. My phone number is one longer than that (11 digits). If you drop the 0 prefix and use +44 instead, that'll be 12 digits (or 13 if you include the + but you could specify that as always present.) (A minor nit since it only increases the search space 10x or 100x which probably doesn't make a huge impact?)
- grupthink 5y agoYes you're right. Thanks for the correction.