Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

For the purposes of entropy, you need only consider 10 valid choices for each symbol of a phone number so it's closer to 33.21 bits (10 * (log(10) / log(2))) and smaller still when discarding impossible area, trunk & subscriber numbers.


And then a bit larger again when including foreign phone numbers.


No, I'm describing the truncated hash. Signal truncates SHA1 to 10 bytes of output.

No matter if your phone number is six digits or sixteen, Signal uses 10 bytes (80 bits) of the hash.


So given than 80 bits is much bigger than 30-40 bits, if I know someone's hash I can very easily narrow down their phone number to one or sometimes two candidates.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: