Hacker News new | ask | show | jobs
by mstute 1881 days ago
There is no need to brute force. We can build a rainbow table with valid phone numbers, which we can use to lookup a phone number hash in real time (about 50ms on a regular desktop machine). PoC available here: https://github.com/seemoo-lab/opendrop/blob/poc-phonenumber-...
1 comments

Can't believe Apple doesn't understand rainbow tables.
It's not a problem of existence of rainbow table or not salted, but the problem is that hash is not very meaningful for secret on small space, like phone number (something like 10^13 even larger?).