Airdrop doesn't use cryptographic salts, and rainbow tables are easily able to de-anonymize users Nations like China are already taking advantage of this. Here's how it works: 1. Airdrop broadcasts a Bluetooth advertisement 2. Advertisement contains a partial hash of the sender's phone + email address 3. If the hashes in the recipients device match, they authenticate and allow file sharing. Because they (can't) be salted, the SHA256 hashes of all possible phone numbers for a single nation are easily computable into a rainbow table only a few TB large. Then it's just a matter of looking up the hash to de-anonymize the original sender. There is currently no way to prevent your phone number and email address from being leaked via Airdrop.