Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by arnaudsm | Hacker News Reader

Parent Full thread

arnaudsm·

I'm working on exactly that, using k-anonymity too. I expect to release my tool within 24h

View on HN

How could a tool that checks for a specific phone number be k-anonymous?

By using partial sha256 hashes + padding, and doing the checking locally

It can't. Or at least, not while remaining useful for the haveibeenpwned use case.

It's also an interesting choice for a search tool for a quasi-public dataset.

In the same way as for passwords.

Nah because you can iterate through all phone numbers pretty quickly.

Iterating through passwords is not slower. And in practice there's no need to iterate, you just download the leak and see phone numbers there.

Agreed, just saying it's especially trivial for phone numbers.

Looking forward to the Show HN. Keep us posted.

The Website is now live at https://fbleak.info/ !

Discussion here: https://news.ycombinator.com/item?id=26702473

US only :(

This is a easy way to collect phone numbers of concerned Facebook users.

Facebook then allows the person collecting phone numbers to search for the name of the user associated with a phone number (or email address).

https://mbasic.facebook.com/login/identify/?ctx=recover

I believe this has been limited more recently. I just put my number in there and it just says that I can click OK to text myself a password reset, but didn't leak any details on screen.

where should we go for your tool?

It's now live on https://fbleak.info/, and it's open-source !

Reply on news.ycombinator.com