Hacker News Reader

Comment by eknkc | Hacker News Reader

What would salting do? The sender would need to share the salt anyway. I guess it would eliminate a database of number hashes approach but brute forcing a salted phone number hash should not be a big problem in any case.

View on HN

Salting would prevent an attacker from being able to find your phone number by hashing every possible phone number in your area code and comparing each hash with what they captured over the air.

Or am I misunderstanding something?

SHA-256 is designed to be quick to compute, so with salt and maybe some guessing of area code the march can be found within seconds. For salt to make a difference they’d need to use some intentionally slow hash functions, like bcrypt.

Not really. As the salt is known, they can still do this easily. They just can't make a rainbow table of it. That's the only thing salting really accomplishes.

You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch.

Just out of curiousity, took a look at some benchmarks and apparently a M2 macbook pro can hit 300MH/s easily. That would mean something like 30 seconds to hash the entire search space. I guess specilaized GPU implementations can do a lot better.

Take this with a grain of salt though, I did not test the speed claim myself.

You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch.

Oooookay. I'll show myself out.

Not sure why the sarcasm.

Security should not be implemented by anyone who is not a subject matter.

It's a subject where it's easy to sound informed while being completely wrong.

I'm of the opinion this should be a development interview question.

"How would you implement {security solution} from scratch" -- The only acceptable answer being refusal.

Reply on news.ycombinator.com