3 ms·
> Well, AirDrop seems to be less anonymous than we thought. It's possible to identify you: your phone sends out SHA256 your phone number hash to all the devices
by mullingitover 3y ago
> Well, AirDrop seems to be less anonymous than we thought. It's possible to identify you: your phone sends out SHA256 your phone number hash to all the devices around you every time you hit Share.
It's wild that this hash isn't salted.
- mcculley 3y agoHow would salting work in this scenario? Both devices would have to share the salt, wouldn’t they?
- gruez 3y agoYou broadcast salt || SHA256(phone number || salt). If you know the original phone number, you can check whether it's a match.
- eknkc 3y agoAnd if you don’t know the phone number you can brute force that pretty easily and it’s all the same. How many bits of enthropy are there on phone numbers?
- deleted 3y ago[deleted]
- l3s2d 3y agoThis doesn't seem any more secure than broadcasting SHA256(phone number).
- judge2020 3y agoAll it does is marginally increase the cost of reverse engineering the sha2. Instead of having a rainbow table of every phone number’s salt, you generate one with that salt whenever you want to get the phone number it broadcasted.
- wkat4242 3y agoYeah and you probably won't even need to rainbow that because it's a pretty quick operation on a decent GPU. For example here in Spain we have only 100 million mobile numbers. That sounds like a lot but it's peanuts for a gpu. Going through the entire keyspace would take a fraction of a second because my 4090 can do 20 billion salted SHA256 hashes per second!
- upon_drumhead 3y agoEither the salt has to be static for all phones in the area, or it has to be calculable, which in the end is pretty much the same as it is now.
- graphe 3y agoWhat's the point? I'm serious. It's to send shit to potentially random people and your friends.
- wkat4242 3y agoTargeted phishing attacks maybe?