3 ms·
What problem would this solve? If my problem is that I don't want Facebook to have the phone numbers in my address book, then surely I don't want them to have
by feral 15y ago
What problem would this solve?
If my problem is that I don't want Facebook to have the phone numbers in my address book, then surely I don't want them to have the SHA1 of each of the numbers in my address book, either?
Isn't it going to be easy for an organisation with Facebook's resources to build a dictionary of the space of SHA1s of phone numbers?
And if they salt the numbers, first, then they can't be compared with each other for suggestions? So whats the point?
Have I overlooked something?
- skybrian 15y agoIt avoids accidents. With plain text data, there is a lot of room for accidentally leaking private data (for example, to server logs). Building a sha1 dictionary isn't something you do by accident.
- extension 15y agoFacebook only knows the contacts that match i.e. are already on Facebook. And that's exactly what the user wanted to find out. It's true that they could store the hashes and build a graph of mystery contacts, but that's still not as bad as taking the actual contact info.