3 ms·

Maybe they should store salted hashes of phone numbers. The purposes of phone numbers: 1. Verify you are a not a bot: no need to store anything except TRUE on

Maybe they should store salted hashes of phone numbers. The purposes of phone numbers: 1. Verify you are a not a bot: no need to store anything except TRUE once verified. 2. 2FA - well use something better than SMS, but if you must, store the hash, and make me enter my number for the 2FA each time. Compare with hash and then send SMS.

quickthrower2 4y ago
Downvote explainer?
modernerd 4y ago
Didn’t downvote and think your idea is reasonable, but worth noting that twitter currently needs unhashed phone numbers for: - Account search during password recovery (lets users search for their account by phone number): https://twitter.com/account/begin_password_reset https://twitter.com/account/begin_password_reset - User discoverability and account recommendations (users who upload their address books can find others by phone number, users who share their number can be found by others): https://help.twitter.com/en/using-twitter/account-suggestions https://help.twitter.com/en/using-twitter/account-suggestion... Hashing numbers has other implications, like support impact (some folks don’t know their own phone number), preventing the ability to offer SMS updates in countries that need it (or to reactivate that feature in national emergencies for countries that SMS support was pulled from), as well as making potential marketing, data mining, satisfying legal requests, and future feature development harder. So your suggestion is a good one for a privacy-conscious service that doesn’t already depend on (or that is unwilling to relinquish) unhashed numbers, but it probably isn’t in the nature of twitter to seek to protect user data at the expense of existing or future features, even after leaks like this.
- account42 4y ago
  Not to mention that only having salted hashes will make it harder for them to link your advertising profile with other data brokers.
cudder 4y ago
Non-geeks dislike the hassle of 2FA enough as it is, having to enter their phone number every time too sounds like it would hurt adoption quite significantly.
- vinay_ys 4y ago
  With technology like FIDO Passkey built into newer phones (both iOS and Android), I see passwordless multi-factor attested auth becoming the standard for most services very soon. Then, users will have to do even less to get more security.

quickthrower2 4y ago

Downvote explainer?

modernerd 4y ago

Didn’t downvote and think your idea is reasonable, but worth noting that twitter currently needs unhashed phone numbers for: - Account search during password recovery (lets users search for their account by phone number): https://twitter.com/account/begin_password_reset https://twitter.com/account/begin_password_reset - User discoverability and account recommendations (users who upload their address books can find others by phone number, users who share their number can be found by others): https://help.twitter.com/en/using-twitter/account-suggestions https://help.twitter.com/en/using-twitter/account-suggestion... Hashing numbers has other implications, like support impact (some folks don’t know their own phone number), preventing the ability to offer SMS updates in countries that need it (or to reactivate that feature in national emergencies for countries that SMS support was pulled from), as well as making potential marketing, data mining, satisfying legal requests, and future feature development harder. So your suggestion is a good one for a privacy-conscious service that doesn’t already depend on (or that is unwilling to relinquish) unhashed numbers, but it probably isn’t in the nature of twitter to seek to protect user data at the expense of existing or future features, even after leaks like this.

account42 4y ago
Not to mention that only having salted hashes will make it harder for them to link your advertising profile with other data brokers.

cudder 4y ago

Non-geeks dislike the hassle of 2FA enough as it is, having to enter their phone number every time too sounds like it would hurt adoption quite significantly.

vinay_ys 4y ago
With technology like FIDO Passkey built into newer phones (both iOS and Android), I see passwordless multi-factor attested auth becoming the standard for most services very soon. Then, users will have to do even less to get more security.