Comment by shim__

> If I remember correctly all they stored was an account ID and a UNIX timestamp such as the last login.

How do they perform address book matching without an phone number? It just being accessible by SGX does not really count as not storing it.

Problem with phone numbers is they are to short to store as a hash, since you can brute force the sha256 of an phone number in a trivial amount of time on a single consumer device