Hacker News Reader

> Furthermore, the app privacy label on the App Store claims that this service collects your contacts. So much for privacy, then.

FWIW, it’s up to the user whether to allow that. I don’t recall the language the app uses to describe the contact request, it seemed reasonable but I didn’t allow it.

View on HN

Correct. Sharing contact information is opt-in, and what gets stored on the server is only salted and hashed phone numbers, not even names. It’s just a way to find people on Wavelength whose phone numbers are in your contacts. Also, if you later choose to delete your contacts from Wavelength, everything stored on the server is deleted. The privacy policy makes this clear, I think.

Salting and hashing phone numbers doesn’t do much to obfuscate them because the whole range of phone numbers is brute-forcible. Wavelength (or any attacker who gains access to Wavelength’s database) effectively has all phone numbers users upload. To reverse the hashing, just compute 10 million hashes per valid US area code.

And it’s a tiny amount of work if you just want to know which users have a contact with one specific phone number.

Much better would be to store no contact information at all server-side.

Reply on news.ycombinator.com