2 ms·
One reason many well-meaning security teams want mobiles is that phone numbers "cost" money for (most) attackers to create but do not create much additional bur
by xyzzy123 4y ago
One reason many well-meaning security teams want mobiles is that phone numbers "cost" money for (most) attackers to create but do not create much additional burden for (most) legitimate users.
In a sense they are used as a kind of "hashcash" to raise the cost of fake accounts.
You can improve privacy by one-way transforming the number in a way your systems can't undo (eg hmac with a key in hsm configured for enc only, with rate limiting), but naively you lose agility and some useful capability (eg ban accounts with numbers from this range).
- solarkraft 4y agoIt's also something the service provider has to do and I can't verify as a user.
- oarsinsync 4y ago> You can improve privacy by one-way transforming the number in a way your systems can't undo (eg hmac with a key in hsm configured for enc only, with rate limiting), but naively you lose agility and some useful capability (eg ban accounts with numbers from this range). So store two hashes, one being the whole number, another being the number excluding the last 2 digits. These aren’t difficult problems to solve. The bigger issue is that they’re not revenue generating solutions, but rather the opposite.