3 ms·
Note that for short messages, hashes are unlikely to effectively conceal the content. English text has about 1 bit of information per character, and auto-sent m
by MauranKilom 4y ago
Note that for short messages, hashes are unlikely to effectively conceal the content. English text has about 1 bit of information per character, and auto-sent messages are going to contain even less information. Not that google is likely to have a particular interest in that one-time code you receive via SMS, but it could almost surely brute-force the hash in a fraction of a second if it did.
- iratewizard 4y agoThe easier it is to brute force an sms message hash, the less sensitive the information is. Generally.
- yencabulator 4y ago6-digit numerical codes are pretty easy to brute-force, and some of the most sensitive things transported over SMS.
- batch12 4y agoI read this as hashing the content for verification, not hashing for concealment.
- brettproctor 4y agoI figured it was unlikely google would make such a mistake, so I looked at the docs. They use public key cryptography to generate a private shared secret that is hashed alongside the message. This prevents the brute force hash attack. https://developers.google.com/business-communications/verified-sms/guides/learn#life https://developers.google.com/business-communications/verifi...
- eru 4y agoAwesome! Thanks for looking this up, instead of just speculating. Btw, in some sense this is exactly the same stuff you'd have to do to make committing to a single-bit work. Or encrypting a short message, in a way that's not easy to crack.