Hacker News Reader

Comment by jamiesonbecker | Hacker News Reader

It's just hashed. I.e., pick a unique number that matches your phone number and just always use that one instead, because the value in your phone number is not the functionality of calling you, but matching you up with all of your other metadata, content, "Likes", etc.

So the goal isn't to sell YOU. You are boring and prosaic. No advertiser cares about you personally.

We'll make money by selling your likes and who you're connected to in this fuzzy, aggregate format. Advertisers want to sell to a group of people who look just like you.

View on HN

> It's just hashed

but the key space is way too small for a hash to be a meaningful anonymization mechanism. It's too easy to build a rainbow table for possible phone numbers.

How do you know what hashing algorithm is being used? And what salt?

The algorithm and salt are irrelevant. There are only so many phone numbers... You could brute force the hash of a phone number in seconds on any modern computer.

> The algorithm and salt are irrelevant.

Given any input domain, you can choose an algorithm that will make bruteforcing the entire domain take as long as you like. As an extreme example, bcrypt with a work factor of 20 takes over a minute to calculate a single hash on a high-end desktop. (Of course, whether whatsapp are actually doing any of this is another question).

Ok, there is no _practical_ algorithm that would matter for a keyspace this small. Assuming they are hashing the values at all, I think it's pretty unlikely they are using a high work factor KDF...

Unless you know the original algorithm, any collisions you find are useless.

I'll give you an example. Here's a hashcode from a real phone number: 1786883671916465751. What's the phone number I used to generate it?

Pretty sure Facebook can find out which hash function WhatsApp is using.

Or they can just get the original data... So why complain that hashing is insecure?

With one hash, that would obviously be impossible. With millions? Trivial... Particularly when you already know the phone numbers for many of the users (those who have added their number to their profile), and you can match against contact databases.

If you're going to cheat by using your contacts database, why not just ask your colleague for the original data?

Even with hundreds of millions of observations, the space of possible hashing algorithms that map phone numbers onto those hash codes is infinite. Well, not infinite, but the space of functions that map phone numbers onto whatever domain the hash codes have is mind bogglingly large.

Reply on news.ycombinator.com