5 ms·
Unless it's changed recently, the phone number is user-supplied and I'm not sure if it's verified at all. They do claim that the phone number "will be stored as
by ja27 13y ago
Unless it's changed recently, the phone number is user-supplied and I'm not sure if it's verified at all. They do claim that the phone number "will be stored as unique mathematical representations (or 'hashes')..." rather than plaintext, but I imagine if you know it's a non-salted phone number that's been hashed, it's pretty easy to brute force. But were they lying about hashing the phone numbers? I guess it doesn't matter if they hashed the phone numbers if they're going to expose an unlimited query API that can be brute-forced like this.
- boxy 13y agojaz27: Why is your comment grey? Did they really claim phone numbers are hashed? If so, why has nobody else touched on this subject?
- elliottcarlson 13y agoPosts get grayer due to downvotes. The more downvotes, the lighter the text will be.
- ja27 13y agoYes. I signed up in-app today (with a fake phone number) and that's a direct quote from the app. No idea on the downvotes. I guess because, like I said, telling users you hash the phone numbers doesn't matter if you're using them to search for an unhashed userid. But they're implying to users that their phone numbers are secure because they're hashed, when it really doesn't matter.
- stouset 13y agoSalts, in a cryptographic context, are considered to be public. Salting does not mitigate a brute force attack against a limited search space.