Hackenews allows to register anonymously (doesn't require an email)

3 pointstraxsho4 comments

Would it be legal (and feasible) to create a community that requires a phone number verification but the number is not stored anywhere?

View on HN

You could store the phone number in hashed form and require the user to enter their phone number for the one-time text every time they log in, if the hashed phone number matches the hash you have stored for the user account, then send the verification text and let the user enter that to complete login. This way you can use a phone number for verification while not actually storing the phone number.

you do run into the issue that getting ahold of extra phone numbers is fairly trivial, so you can’t really rely on phone numbers alone to keep bad actors out.

There’s also the issue that there aren’t _that_ many phone numbers. A determined attacker who got access to the hashed phone numbers could recover the numbers they were interested in with a brute force attack.

Isn't this exactly what salting (and peppering) prevents?

I have to say that requiring phone numbers is an obnoxious practice. I don't have (or want) a phone number so I would be unable to participate in such a community.

Reply on news.ycombinator.com