Didn’t downvote and think your idea is reasonable, but worth noting that twitter currently needs unhashed phone numbers for:

- Account search during password recovery (lets users search for their account by phone number): https://twitter.com/account/begin_password_reset

- User discoverability and account recommendations (users who upload their address books can find others by phone number, users who share their number can be found by others): https://help.twitter.com/en/using-twitter/account-suggestion...

Hashing numbers has other implications, like support impact (some folks don’t know their own phone number), preventing the ability to offer SMS updates in countries that need it (or to reactivate that feature in national emergencies for countries that SMS support was pulled from), as well as making potential marketing, data mining, satisfying legal requests, and future feature development harder.

So your suggestion is a good one for a privacy-conscious service that doesn’t already depend on (or that is unwilling to relinquish) unhashed numbers, but it probably isn’t in the nature of twitter to seek to protect user data at the expense of existing or future features, even after leaks like this.

Not to mention that only having salted hashes will make it harder for them to link your advertising profile with other data brokers.

Non-geeks dislike the hassle of 2FA enough as it is, having to enter their phone number every time too sounds like it would hurt adoption quite significantly.

With technology like FIDO Passkey built into newer phones (both iOS and Android), I see passwordless multi-factor attested auth becoming the standard for most services very soon. Then, users will have to do even less to get more security.

Downvote explainer?