Hacker News Reader

Comment by CamperBob2 | Hacker News Reader

Wow, not salting the phone number before hashing it was a pretty amateur move. Whoever did that made other mistakes... bank on it.

View on HN

Assuming that there's some functionality by which if you know someone's phone number, you can identify them in some UI, how would you salt this?

Do you salt all the phone numbers with the same salt? Do you send out the salt and expect phones to respond with the salted hashes (in which case, how does this achieve anything?). Do you salt based on geographic location? (Again...) Do you make every phone use the same salt and try to hide it?

What would salting do? The sender would need to share the salt anyway. I guess it would eliminate a database of number hashes approach but brute forcing a salted phone number hash should not be a big problem in any case.

Salting would prevent an attacker from being able to find your phone number by hashing every possible phone number in your area code and comparing each hash with what they captured over the air.

Or am I misunderstanding something?

SHA-256 is designed to be quick to compute, so with salt and maybe some guessing of area code the march can be found within seconds. For salt to make a difference they’d need to use some intentionally slow hash functions, like bcrypt.

Not really. As the salt is known, they can still do this easily. They just can't make a rainbow table of it. That's the only thing salting really accomplishes.

You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch.

Just out of curiousity, took a look at some benchmarks and apparently a M2 macbook pro can hit 300MH/s easily. That would mean something like 30 seconds to hash the entire search space. I guess specilaized GPU implementations can do a lot better.

Take this with a grain of salt though, I did not test the speed claim myself.

You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch.

Oooookay. I'll show myself out.

Not sure why the sarcasm.

Security should not be implemented by anyone who is not a subject matter.

It's a subject where it's easy to sound informed while being completely wrong.

I'm of the opinion this should be a development interview question.

"How would you implement {security solution} from scratch" -- The only acceptable answer being refusal.

Reply on news.ycombinator.com