Hacker News Reader

Comment by CamperBob2 | Hacker News Reader

Salting would prevent an attacker from being able to find your phone number by hashing every possible phone number in your area code and comparing each hash with what they captured over the air.

Or am I misunderstanding something?

View on HN

SHA-256 is designed to be quick to compute, so with salt and maybe some guessing of area code the march can be found within seconds. For salt to make a difference they’d need to use some intentionally slow hash functions, like bcrypt.

Not really. As the salt is known, they can still do this easily. They just can't make a rainbow table of it. That's the only thing salting really accomplishes.

You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch.

Just out of curiousity, took a look at some benchmarks and apparently a M2 macbook pro can hit 300MH/s easily. That would mean something like 30 seconds to hash the entire search space. I guess specilaized GPU implementations can do a lot better.

Take this with a grain of salt though, I did not test the speed claim myself.

You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch.

Oooookay. I'll show myself out.

Not sure why the sarcasm.

Security should not be implemented by anyone who is not a subject matter.

It's a subject where it's easy to sound informed while being completely wrong.

I'm of the opinion this should be a development interview question.

"How would you implement {security solution} from scratch" -- The only acceptable answer being refusal.

Reply on news.ycombinator.com