Re:‘Anonymous’ Chat App Hijacks Contact Data
by jsjohnst on Thursday August 31, 2017 @10:10AM
(#15140399)
Git defaults to using 7 hex characters for short hashs and doesn't see collisions for 95+% of repos. Even the Linux kernel repo with all its objects only needs 12 characters to ensure uniqueness.
[ Parent
| on HN ]
Re:‘Anonymous’ Chat App Hijacks Contact Data
by baystep on Thursday August 31, 2017 @10:51AM
(#15140695)
Yes, but if (it seems more like when) a collision happens in a situation like this, aren't we essentially saying someone is connected with someone they don't even know? I feel like detecting the collision takes more computation then just sending the whole hash right? I mean in consideration of the scale that Signal/WhatsApp/etc are with millions of phone numbers
Re:‘Anonymous’ Chat App Hijacks Contact Data
by jsjohnst on Thursday August 31, 2017 @11:08AM
(#15140830)
With a couple GPUs you could find out if there is a collision on phone numbers with truncated hashes pretty quickly. If the phone numbers are normalized, except for a few edge cases, the space is twelve digits which can be naively brute forced. A trillion SHA-1 hashes isn't that hard to do these days.