Hacker News Reader

Correct. Sharing contact information is opt-in, and what gets stored on the server is only salted and hashed phone numbers, not even names. It’s just a way to find people on Wavelength whose phone numbers are in your contacts. Also, if you later choose to delete your contacts from Wavelength, everything stored on the server is deleted. The privacy policy makes this clear, I think.

View on HN

Salting and hashing phone numbers doesn’t do much to obfuscate them because the whole range of phone numbers is brute-forcible. Wavelength (or any attacker who gains access to Wavelength’s database) effectively has all phone numbers users upload. To reverse the hashing, just compute 10 million hashes per valid US area code.

And it’s a tiny amount of work if you just want to know which users have a contact with one specific phone number.

Much better would be to store no contact information at all server-side.

Reply on news.ycombinator.com