Hacker News new | past | comments | ask | show | jobs | submit login

You broadcast salt || SHA256(phone number || salt). If you know the original phone number, you can check whether it's a match.



And if you don’t know the phone number you can brute force that pretty easily and it’s all the same. How many bits of enthropy are there on phone numbers?


All it does is marginally increase the cost of reverse engineering the sha2. Instead of having a rainbow table of every phone number’s salt, you generate one with that salt whenever you want to get the phone number it broadcasted.


Yeah and you probably won't even need to rainbow that because it's a pretty quick operation on a decent GPU. For example here in Spain we have only 100 million mobile numbers. That sounds like a lot but it's peanuts for a gpu. Going through the entire keyspace would take a fraction of a second because my 4090 can do 20 billion salted SHA256 hashes per second!


This doesn't seem any more secure than broadcasting SHA256(phone number).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: