3 ms·
Hash functions are only incredibly difficult to invert when the input domain is large, which is not the case with phone numbers. Even if you use a password hash
by patrec 4y ago
Hash functions are only incredibly difficult to invert when the input domain is large, which is not the case with phone numbers. Even if you use a password hashing function that takes 1s to run (and if you need to frequently compare the hash, that's on the high side), you could practically invert the hash of an individual phone number. For this use case making it relatively expensive to obtain a single number in the clear would probably be good enough though.
- robertlagrant 4y agoSalting exists for this reason.
- ShowalkKama 4y agoeven with salting it'd be trivial
- eps 4y agoAnd how exactly would salting fit into matching plaintext phone numbers against a large blacklist?
- Vinnl 4y agoHow would that work if someone re-uploads your phone number? If it's not hashed with the same salt, then that wouldn't be blocked?
- robertlagrant 4y agoWell, quite :) I don't see how the thing is supposed to work, given that people get other people's phone numbers when they change number. The only way to actually fix it is to stop uploading a user's contacts to their servers in the first place.