5 ms·

This worries me. What exactly do you mean by encrypted in the DB? If you actually mean hashed using a one-way function, it would be very easy to hash every pos

by tyho 11y ago

This worries me. What exactly do you mean by encrypted in the DB? If you actually mean hashed using a one-way function, it would be very easy to hash every possible phone number (there are not that many) to build a lookup table to deanonymise your users instantly. Even if you individually salt each hash it would not take very long at all to find the phone number for each entry. If you do mean encrypted, then authorities could compel you to turnover the database and the key. Why do you need to store the phone number in any way at all?

yemyat91 11y ago
Yes, it is possible to match a phone number to a hash. (We are also looking at ways to make it more secure. If you have any suggestion, please let us know.) However, hushes are not connected with the phone number, we created unique token for our user when the hush is created. We needed phone numbers for our upcoming features. The newer version which won't need phone number to login is on its way.
- towelguy 11y ago
  > We needed phone numbers for our upcoming features. > The newer version which won't need phone number to login is on its way. So which is it? new features need the phone number but the new version won't require it? Are you gonna ask users for permission to use their phone number to access the new features? Will users who prefer their anonymity be able to interact with users who surrender their identification? Isn't the unique token good enough?
derpleplex 11y ago
Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything that exists is susceptible to being broken, misused, or modified. If you assume that your attackers know everything, and have the ability to immediately find and apply that knowledge, then yes, it can seem scary. But I tend to think that the more capacity a person has to do, it's really just a bigger intellectual burden.
- mc808 11y ago
  So it sounds like messages are associated with accounts, and accounts are linked to phone numbers, and those phone numbers are easily recoverable from a centralized database. If htat's accurate then it's not simply imperfect anonymity. It's not even pseudo-anonymous. It's about as not-anonymous as it gets, which is fine for a casual messaging/chat app where no anonymity is expected. But users should not be misled into thinking it's safe to use it for anything they wouldn't say to a government official's face.
  - deleted 11y ago
    [deleted]
  - derpleplex 11y ago
    You are right, I was reacting to a pattern of argument, which is not the point that I should have been focused on. That creates more noise over more important issues.
- jlebar 11y ago
  > What is the point in finding every possible flaw with security here? Because security is only as good as its weakest link, and an adversary who wants your sensitive data won't choose not to break in because your security is "mostly OK". At the risk of being overly negative, if you have this attitude, you're not building a secure system, and, for your users' sakes, you shouldn't say that you are.
  - derpleplex 11y ago
    That was not my point, I over-reacted to a pattern of argument that bothers me when my own mind repeats it. I agree that security should be taken seriously, with care and caution, and that users who ethically need to be aware of potentially fallacious assumptions about the usage of a device should have the capacity to easily find that information.
    - jlebar 11y ago

by tyho 11y ago

yemyat91 11y ago

Yes, it is possible to match a phone number to a hash. (We are also looking at ways to make it more secure. If you have any suggestion, please let us know.) However, hushes are not connected with the phone number, we created unique token for our user when the hush is created. We needed phone numbers for our upcoming features. The newer version which won't need phone number to login is on its way.

towelguy 11y ago
> We needed phone numbers for our upcoming features. > The newer version which won't need phone number to login is on its way. So which is it? new features need the phone number but the new version won't require it? Are you gonna ask users for permission to use their phone number to access the new features? Will users who prefer their anonymity be able to interact with users who surrender their identification? Isn't the unique token good enough?

derpleplex 11y ago

Perfect security does not currently exist. A trusted source must store the information somewhere, to authorize and validate users without spreading that information elsewhere. You can't get around this problem unless you invent magic psychic computers. What is the point in finding every possible flaw with security here? There is a gradient of complexity, the time it takes to break these things. Currently, everything that exists is susceptible to being broken, misused, or modified. If you assume that your attackers know everything, and have the ability to immediately find and apply that knowledge, then yes, it can seem scary. But I tend to think that the more capacity a person has to do, it's really just a bigger intellectual burden.

mc808 11y ago
So it sounds like messages are associated with accounts, and accounts are linked to phone numbers, and those phone numbers are easily recoverable from a centralized database. If htat's accurate then it's not simply imperfect anonymity. It's not even pseudo-anonymous. It's about as not-anonymous as it gets, which is fine for a casual messaging/chat app where no anonymity is expected. But users should not be misled into thinking it's safe to use it for anything they wouldn't say to a government official's face.
- deleted 11y ago
  [deleted]
- derpleplex 11y ago
  You are right, I was reacting to a pattern of argument, which is not the point that I should have been focused on. That creates more noise over more important issues.
jlebar 11y ago
> What is the point in finding every possible flaw with security here? Because security is only as good as its weakest link, and an adversary who wants your sensitive data won't choose not to break in because your security is "mostly OK". At the risk of being overly negative, if you have this attitude, you're not building a secure system, and, for your users' sakes, you shouldn't say that you are.
- derpleplex 11y ago
  That was not my point, I over-reacted to a pattern of argument that bothers me when my own mind repeats it. I agree that security should be taken seriously, with care and caution, and that users who ethically need to be aware of potentially fallacious assumptions about the usage of a device should have the capacity to easily find that information.
  - jlebar 11y ago