5 ms·

Android supports "verified SMS" wherein the sender proves their identity to Google, tells Google the hashes of messages they send, and Google can tell recipient

• MauranKilom 4y ago
  Note that for short messages, hashes are unlikely to effectively conceal the content. English text has about 1 bit of information per character, and auto-sent messages are going to contain even less information. Not that google is likely to have a particular interest in that one-time code you receive via SMS, but it could almost surely brute-force the hash in a fraction of a second if it did.
  • iratewizard 4y ago
    The easier it is to brute force an sms message hash, the less sensitive the information is. Generally.
    • yencabulator 4y ago
      6-digit numerical codes are pretty easy to brute-force, and some of the most sensitive things transported over SMS.
  • batch12 4y ago
    I read this as hashing the content for verification, not hashing for concealment.
  • brettproctor 4y ago
    I figured it was unlikely google would make such a mistake, so I looked at the docs. They use public key cryptography to generate a private shared secret that is hashed alongside the message. This prevents the brute force hash attack. https://developers.google.com/business-communications/verified-sms/guides/learn#life https://developers.google.com/business-communications/verifi...
    • eru 4y ago
      Awesome! Thanks for looking this up, instead of just speculating. Btw, in some sense this is exactly the same stuff you'd have to do to make committing to a single-bit work. Or encrypting a short message, in a way that's not easy to crack.
• skeletonjelly 4y ago
  Sounds like DKIM https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail