Hacker News Reader

There is no need to brute force. We can build a rainbow table with valid phone numbers, which we can use to lookup a phone number hash in real time (about 50ms on a regular desktop machine). PoC available here: https://github.com/seemoo-lab/opendrop/blob/poc-phonenumber-...

Can't believe Apple doesn't understand rainbow tables.

It's not a problem of existence of rainbow table or not salted, but the problem is that hash is not very meaningful for secret on small space, like phone number (something like 10^13 even larger?).

> Sure, I'll take your statement that AirDrop hashes aren't as robust as they should be at face value, but I'm going to need you to provide more information. Of course, the PDFs have this, but the article would do well to better summarize.

Does the article they published about that which they link to not provide enough details? In that news release they referenced, they say "However, the research team shows that with new and optimized attack strategies, the low entropy of phone numbers enables attackers to deduce corresponding phone numbers from cryptographic hashes within milliseconds."

I'm not sure if I'm misunderstanding what you're asking, or if you just didn't notice that they provide the info you want fairly easily and succinctly already.

Whats _multiple_? If it takes 20 high end Tesla to crack this real-time, a desktop could feasibly brute force the hashes in hours, and a laptop could do so in a day. This is good enough for targetted attacks to be practical.