4 ms·

What would salting do? The sender would need to share the salt anyway. I guess it would eliminate a database of number hashes approach but brute forcing a salte

by eknkc 3y ago

What would salting do? The sender would need to share the salt anyway. I guess it would eliminate a database of number hashes approach but brute forcing a salted phone number hash should not be a big problem in any case.

CamperBob2 3y ago
Salting would prevent an attacker from being able to find your phone number by hashing every possible phone number in your area code and comparing each hash with what they captured over the air. Or am I misunderstanding something?
- YeBanKo 3y ago
  SHA-256 is designed to be quick to compute, so with salt and maybe some guessing of area code the march can be found within seconds. For salt to make a difference they’d need to use some intentionally slow hash functions, like bcrypt.
- trifurcate 3y ago
  You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch.
  - CamperBob2 3y ago
    You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch. Oooookay. I'll show myself out. /s
    - Clent 3y ago
      Not sure why the sarcasm. Security should not be implemented by anyone who is not a subject matter. It's a subject where it's easy to sound informed while being completely wrong. I'm of the opinion this should be a development interview question. "How would you implement {security solution} from scratch" -- The only acceptable answer being refusal.
  - eknkc 3y ago
    Just out of curiousity, took a look at some benchmarks and apparently a M2 macbook pro can hit 300MH/s easily. That would mean something like 30 seconds to hash the entire search space. I guess specilaized GPU implementations can do a lot better. Take this with a grain of salt though, I did not test the speed claim myself.
- wkat4242 3y ago
  Not really. As the salt is known, they can still do this easily. They just can't make a rainbow table of it. That's the only thing salting really accomplishes.

by eknkc 3y ago

CamperBob2 3y ago

Salting would prevent an attacker from being able to find your phone number by hashing every possible phone number in your area code and comparing each hash with what they captured over the air. Or am I misunderstanding something?

YeBanKo 3y ago
SHA-256 is designed to be quick to compute, so with salt and maybe some guessing of area code the march can be found within seconds. For salt to make a difference they’d need to use some intentionally slow hash functions, like bcrypt.
trifurcate 3y ago
You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch.
- CamperBob2 3y ago
  You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch. Oooookay. I'll show myself out. /s
  - Clent 3y ago
    Not sure why the sarcasm. Security should not be implemented by anyone who is not a subject matter. It's a subject where it's easy to sound informed while being completely wrong. I'm of the opinion this should be a development interview question. "How would you implement {security solution} from scratch" -- The only acceptable answer being refusal.
- eknkc 3y ago
  Just out of curiousity, took a look at some benchmarks and apparently a M2 macbook pro can hit 300MH/s easily. That would mean something like 30 seconds to hash the entire search space. I guess specilaized GPU implementations can do a lot better. Take this with a grain of salt though, I did not test the speed claim myself.
wkat4242 3y ago
Not really. As the salt is known, they can still do this easily. They just can't make a rainbow table of it. That's the only thing salting really accomplishes.