Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Best to avoid using the “Have I been facebooked” website

code.express

Post reply on HN
Print view View original

51–57 of 57 posts

Re: Best to avoid using the “Have I been facebooked” website

#51

Post by code-express »

unnouinceput wrote: post #46

So, the main point of this article to avoid that site, is that they could google SHA256 for a known simple number, namely "11111111111" and boom!, this way the site programmer would reverse back to know your number? If that's the case I suggest he would google Bitcoin's SHA256 numbers too. Heck, at ~55k USD per bitcoin, he would become, literally, multimillionaire overnight. What a buffoon! And it hit HN top as well,…

> this way the site programmer would reverse back to know your number?

Author here, and yes that is what I claim. This is actually crypto 101 stuff!

1.) Pre computing SHA256 of a small set of numbers (1111111111 - 9999999999) takes only a couple minutes on your average laptop. That is how people find the preimage (password) of leaked password hashes! More sophisticated techniques use rainbow tables etc.

2.) The preimages of Bitcoins, github commits and file hashes have much more entropy to be able to brute force them. Hence, I will not be able to (with todays computing power) find a pre-image of Bitcoin's SHA256 etc. and sadly not become a millionaire overnight :(

3.) Not related to this but hashing functions do get 'weaker' over time as computing power increases. We don't use MD5 anymore for a reason. SHA1 has attacks now (https://shattered.io/). This is why git to move to SHA256 (https://lwn.net/Articles/811068/). n number of years from now, there will be collision attacks on SHA256 as well, at which point we'll have to move to a better, stronger hash!

Re: Best to avoid using the “Have I been facebooked” website

#52

Post by daniel_j »

frosted-flakes wrote: post #39
daniel_j wrote: post #14

Earlier quoted context omitted.

When searching for a job is the best example. Though these are usually not hidden numbers and for me, if a mobile is calling it's either a wrong number or work related. Spam seems to always a landline.

In North America, all phones, landline or cell, have the same number format: 1 (222) 345-6789, where 222 is the area code.

Oh that's interesting, here in Australia mobile numbers are always 04xx xxx xxx (though according to wikipedia, 5 is also valid but i've not seen it)

Re: Best to avoid using the “Have I been facebooked” website

#53

Post by toast0 »

gfxgirl wrote: post #50
dgrin91 wrote: post #4

Earlier quoted context omitted.

Do you not get spam calls on your phone? Phone numbers that are put into this site are likely to be valid & active, making them valuable data to sell.

So I'm curious. I live in Japan and have a Japanese number. I have a USA number via Google Fi. I get several spam calls on the USA number but zero on the Japan number. Any idea why? It it just luck? It is scammers don't target Japan? Is it some technical difference that makes it harder/impossible/costly in Japan? Is it an enforcement issue? Also what happened / is happening with https://en.wikipedia.org/wiki/STIR/SHA…

A quick look at my voip carrier says calls to us are 1 cent, and calls to Japan land lines are about 2.5 cents, and Japan mobile is 10 cents. They've generally got pretty good pricing; with volume you can get better, but this is a good place to start. So call cost is going to be a lot more.

Then you've got to find voice talent. You can find English voice talent all over the globe, Japanese voice talent is harder to find and probably costs more.

STIR/SHAKEN will likely help somewhat. It should make it easier to track down accounts of callers, but we'll have to see if enforcement becomes effective, or if actionable complaints make enough of a difference. I don't think telephone companies regular record enough metadata for effective enforcement at the moment, and there isn't a reasonable way to report abuse, so most people just shrug and pick up less calls; we really need a useful reporting mechanism (dial * something after you get a spam call should work IMHO; but that's not me doing the work to correlate reports and what not)

Re: Best to avoid using the “Have I been facebooked” website

#54

Post by unnouinceput »

code-express wrote: post #51
unnouinceput wrote: post #46

So, the main point of this article to avoid that site, is that they could google SHA256 for a known simple number, namely "11111111111" and boom!, this way the site programmer would reverse back to know your number? If that's the case I suggest he would google Bitcoin's SHA256 numbers too. Heck, at ~55k USD per bitcoin, he would become, literally, multimillionaire overnight. What a buffoon! And it hit HN top as well,…

> this way the site programmer would reverse back to know your number? Author here, and yes that is what I claim. This is actually crypto 101 stuff! 1.) Pre computing SHA256 of a small set of numbers (1111111111 - 9999999999) takes only a couple minutes on your average laptop. That is how people find the preimage (password) of leaked password hashes! More sophisticated techniques use rainbow tables etc. 2.) The preim…

If you think that hashing 9 billion numbers takes only a few minutes on a laptop you must have a laptop from Star Trek.

Re: Best to avoid using the “Have I been facebooked” website

#56

Post by t0mbstone »

bagels wrote: post #48
sellyme wrote: post #31

Earlier quoted context omitted.

I've encountered a surprising number of people who think that posting your email address publicly is a security risk.

It certainly will get you more emails. Even the unwanted kind.

Eh, so what? I've had the same gmail email address for around 17 years now and I get like 50 spam emails a day that are successfully filtered by their spam protection.

I have to prune my email inbox like a garden. I'm constantly unsubscribing from stuff. It's just the reality of the way how the internet and email works, unfortunately.

Re: Best to avoid using the “Have I been facebooked” website

#57

Post by ASalazarMX »

kalleboo wrote: post #23
aeternum wrote: post #2

It's kinda crazy how paranoid people have become around stuff like phone numbers. Even if this site were recording the numbers, what good is it?

There used to be a time when everyone received a book full of everyone's phone number, name and address... Crazy!

Those numbers rarely were used as access control then, though.
Post reply on HN