5 ms·

Hash the phone number in the browser before sending it to your server. That way it is at least possible to verify via devtools what is being send. Heck. Allow

Hash the phone number in the browser before sending it to your server. That way it is at least possible to verify via devtools what is being send. Heck. Allow even prehashed phone number to be entered.

MarcoBuster 5y ago
That's what we're planning to do. Thank you
brigandish 5y ago
I understand the frustration but they have the data and hence, a rainbow table, sending a pre-hashed phone number is the same as sending an unhashed one, unless the worry is man in the middle, who is just as likely to get the data. The only way to check without giving up personal info is to get the data and look locally, or perhaps search for so many phone numbers that yours is buried in the haystack.
- bra1n 5y ago
  That only holds for numbers already part of the dump. If you submit an unknown phone number that is not contained in the leak, hashing it before sending it will increase data privacy.
  - social_quotient 5y ago
    So a rainbow table of just 2.9 billion numbers covers the USA phone set. So I think searching for a specific number clear or hashed are roughly similar exposures. Maybe the right way to search without disclosure is really to filter. Meaning instead of putting in your full 10 digits. You just put in 7/8 and it returns a list of the rest for you to see. Then you visually scan to find your number out of the returned 9999 results. (Assuming seeing hacked numbers are public already - but I don’t love this either) What’s a secure way of searching without disclosure by either party? (Non troll question)
    - nvoid 5y ago
      > What’s a secure way of searching without disclosure by either party? Download the original data set. US records are around a GB file.
    - deleted 5y ago
      [deleted]
    - CloselyChunky 5y ago
      I think HIBP implements it like this: you hash your email/phone number and send only a prefix of the hash to the server. The server responds with a list of hashes matching the prefix. Now you can check if your hash is in the list. If so, you have been pwned. This way the server never knows which email you are requesting since it only ever sees a part of the hash.

MarcoBuster 5y ago

That's what we're planning to do. Thank you

brigandish 5y ago

I understand the frustration but they have the data and hence, a rainbow table, sending a pre-hashed phone number is the same as sending an unhashed one, unless the worry is man in the middle, who is just as likely to get the data. The only way to check without giving up personal info is to get the data and look locally, or perhaps search for so many phone numbers that yours is buried in the haystack.

bra1n 5y ago
That only holds for numbers already part of the dump. If you submit an unknown phone number that is not contained in the leak, hashing it before sending it will increase data privacy.
- social_quotient 5y ago
  So a rainbow table of just 2.9 billion numbers covers the USA phone set. So I think searching for a specific number clear or hashed are roughly similar exposures. Maybe the right way to search without disclosure is really to filter. Meaning instead of putting in your full 10 digits. You just put in 7/8 and it returns a list of the rest for you to see. Then you visually scan to find your number out of the returned 9999 results. (Assuming seeing hacked numbers are public already - but I don’t love this either) What’s a secure way of searching without disclosure by either party? (Non troll question)
  - nvoid 5y ago
    > What’s a secure way of searching without disclosure by either party? Download the original data set. US records are around a GB file.
  - deleted 5y ago
    [deleted]
  - CloselyChunky 5y ago
    I think HIBP implements it like this: you hash your email/phone number and send only a prefix of the hash to the server. The server responds with a list of hashes matching the prefix. Now you can check if your hash is in the list. If so, you have been pwned. This way the server never knows which email you are requesting since it only ever sees a part of the hash.