6 ms·
They can hash the values they want and compare them with hashed values from other phones.
by jcoder 15y ago
They can hash the values they want and compare them with hashed values from other phones.
- notphilatall 15y agoIt's mostly a question whether they store it or not -- although they have to store it in order to support notifying you when new users who are in your address book join the service. If their servers are compromised, a cracker could still get MOST of the info. Since the hashing function (and salting mechanism) lives on the phone, she could generate a rainbow table of all possible phone numbers and a set of emails for common domains.
- sriramk 15y agoThe hashing won't let them do partial name matches and other 'fuzzy' matching where there isn't an exact text match but strong signals to indicate a match.
- rmc 15y agoNo, but you can hash on guarantee to be unique keys, like phone numbers. Just normalise all phone numbers, hash em, and upload them. Phone numbers are guaranteed to not have transposed characters or abbrevations.
- brudgers 15y agoPhone numbers stored in an address book are not guaranteed to be unique(at least in the US) because they can be stored with or without area code and with or without country code.
- notphilatall 15y agoYou can usually assume that the non-country/area-code numbers have the same country/area code as your current user, if you know their phone number (good thing to get during registration).
- baddox 15y agoHence the normalization step. You can probably guess the country code from other information (e.g. if your app is only in the US). If there's no area code included, then you can't match it up anyway, hashed or otherwise.
- notphilatall 15y agoAgain, hashing won't do much except make you feel fuzzy inside. Since the hashing mechanism is stored on the phone and the possibility space for US phone numbers is extremely limited, it'd be trivial to hash all possible numbers and then do a reverse lookup of the hashed values of your stolen address books.
- quorn3000 15y agoI'm sure it's possible to search within encrypted data. edit: http://www.schneier.com/blog/archives/2009/07/homomorphic_enc.html http://www.schneier.com/blog/archives/2009/07/homomorphic_en...