Hacker News Reader

That only holds for numbers already part of the dump. If you submit an unknown phone number that is not contained in the leak, hashing it before sending it will increase data privacy.

View on HN

So a rainbow table of just 2.9 billion numbers covers the USA phone set. So I think searching for a specific number clear or hashed are roughly similar exposures. Maybe the right way to search without disclosure is really to filter. Meaning instead of putting in your full 10 digits. You just put in 7/8 and it returns a list of the rest for you to see. Then you visually scan to find your number out of the returned 9999 results.

(Assuming seeing hacked numbers are public already - but I don’t love this either)

What’s a secure way of searching without disclosure by either party? (Non troll question)

I think HIBP implements it like this: you hash your email/phone number and send only a prefix of the hash to the server. The server responds with a list of hashes matching the prefix. Now you can check if your hash is in the list. If so, you have been pwned. This way the server never knows which email you are requesting since it only ever sees a part of the hash.

> What’s a secure way of searching without disclosure by either party?

Download the original data set. US records are around a GB file.

Reply on news.ycombinator.com