Re:‘Anonymous’ Chat App Hijacks Contact Data
by StavrosK on Thursday August 31, 2017 @01:22PM
(#15141957)
Yes, but the server doesn't know which of the responses is actually your friend, thus preserving privacy.
[ Parent
| on HN ]
Re:‘Anonymous’ Chat App Hijacks Contact Data
by baystep on Friday September 01, 2017 @08:47AM
(#15147896)
Right, but I'm thinking the server still needs to be able to say "This person who ever they are is definitely the number you have". Like, I wouldn't check my password hashes with only the first 10 bytes, I guess that's why I'm still stuck on the truncated idea.
Re:‘Anonymous’ Chat App Hijacks Contact Data
by StavrosK on Friday September 01, 2017 @02:50PM
(#15151405)
No, the server just says "I know these email addresses starting with 'foo': [email protected], [email protected], [email protected]". If your friend's email address is in there, you know they have Signal.
The hashing is so people can't easily get a list of all the phone numbers, which is easy to work around, but, then again, they could just hammer the endpoint querying for all the various numbers anyway.