Salting and hashing phone numbers doesn’t do much to obfuscate them because the whole range of phone numbers is brute-forcible. Wavelength (or any attacker who

Salting and hashing phone numbers doesn’t do much to obfuscate them because the whole range of phone numbers is brute-forcible. Wavelength (or any attacker who gains access to Wavelength’s database) effectively has all phone numbers users upload. To reverse the hashing, just compute 10 million hashes per valid US area code. And it’s a tiny amount of work if you just want to know which users have a contact with one specific phone number. Much better would be to store no contact information at all server-side.