Shortly thereafter, we implemented practices like rate limiting aimed at addressing these concerns
Did Snapchat really implement “rate limiting”? The evidence suggests otherwise.
First, let me explain what “rate limiting” is and why it’s important.
Snapchat stores people’s phone numbers as a “one-way hash.” This means that when you enter a phone number number like
it will be mathematically converted into a unique string of digits, and then stored on Snapchat’s servers that way, such as:
A one-way hash means that this second number can’t be converted back into the first — so if you were to break into Snapchat’s servers and download all these hashes, you wouldn’t be able to figure out the phone numbers they represent.
But the hashed database does allow you to look up specific numbers to see if they’re in Snapchat’s database. So, if I give Snapchat, say, the hundreds of phone numbers in my phone’s contact list, it can hash each one, see if any of the hashes match its list of hashed phone numbers, and then return Snapchat usernames for each match.
That’s how Find Friend is supposed to work, at least. But remember that we’re dealing with phone numbers here — and all potential phone numbers are already known.
In the U.S., phone numbers just follow a pattern from 111-111-1111 to 999-999-9999. So — as Gibson Security reported in August — if you want to recreate Snachat’s database of phone numbers, all you have to do is send the app each potential number, and then record each matched username that Snapchat spits back to you. Over time, in theory, you’d get a full list of Snapchat’s usernames and phone numbers.
That’s where “rate limiting” comes in. When Snapchat says that it addressed the flaw by implementing rate limiting, it means that its code was supposedly watching out for machines that submitted a suspiciously large number of phone numbers to be matched. If Snapchat notices a computer asking for too many numbers too quickly, that would indicate abuse rather than a legitimate use — and Snapchat would supposedly stop that computer from using Find Friends.
But did the company actually limit Find Friends' match rate? In August, Gibson said that it was able to get Find Friends to match 75,000 phone numbers in an instant — suggesting that there was effectively no rate limiting at all.
Months later, in its Christmas Eve post, Gibson said that the situation hadn’t changed very much. “We were able to crunch through 10 thousand phone numbers … in approximately 7 minutes on a gigabit line on a virtual server,” Gibson said. It added that it could likely speed that up to, at worst, 5,000 phone numbers per minute — meaning that it could scan through Snapchat’s entire user base’s phone numbers in about a day.
To me, that doesn’t sound limited at all. The question now is, what happened? Can Snapchat explain why it thought the problem was fixed when researchers found otherwise? Why didn’t it simply add an upper bound of, say, 1,000 friend matches per user, or some other bright-line limit to how Find Friends could be used?
To help improve the meaning of these lyrics, visit “Find Friends Abuse” by Snapchat and leave a comment on the lyrics box