Hacker News Reader

Comment by esamatti | Hacker News Reader

Hash the phone number in the browser before sending it to your server. That way it is at least possible to verify via devtools what is being send.

Heck. Allow even prehashed phone number to be entered.

View on HN

I understand the frustration but they have the data and hence, a rainbow table, sending a pre-hashed phone number is the same as sending an unhashed one, unless the worry is man in the middle, who is just as likely to get the data.

The only way to check without giving up personal info is to get the data and look locally, or perhaps search for so many phone numbers that yours is buried in the haystack.

That only holds for numbers already part of the dump. If you submit an unknown phone number that is not contained in the leak, hashing it before sending it will increase data privacy.

So a rainbow table of just 2.9 billion numbers covers the USA phone set. So I think searching for a specific number clear or hashed are roughly similar exposures. Maybe the right way to search without disclosure is really to filter. Meaning instead of putting in your full 10 digits. You just put in 7/8 and it returns a list of the rest for you to see. Then you visually scan to find your number out of the returned 9999 results.

(Assuming seeing hacked numbers are public already - but I don’t love this either)

What’s a secure way of searching without disclosure by either party? (Non troll question)

> What’s a secure way of searching without disclosure by either party?

Download the original data set. US records are around a GB file.

I think HIBP implements it like this: you hash your email/phone number and send only a prefix of the hash to the server. The server responds with a list of hashes matching the prefix. Now you can check if your hash is in the list. If so, you have been pwned. This way the server never knows which email you are requesting since it only ever sees a part of the hash.

That's what we're planning to do. Thank you

Reply on news.ycombinator.com