Leaked doc shows how big companies buy credit card data on millions of Americans

From my observations, for data vendors "anonymization" generally just involves replacing a name or credit card number with some other identifier. That's the reality and that's all they are required to do by regulators. People on both sides of the market know and leverage this. There are legitimate use cases that people are after that can only be achieved by having the ability to correlate pseudonymous entities with some kind of history. Lots of data sets would be significantly less valuable, and lots of industry standard analyses unachievable with those identifiers out of the picture. As long as there is no Personally Identifiable Information (which, no, metadata, location history, medical claims, transaction details, don't count). I would imagine that this is something regulators are aware of and that the privacy tradeoff has just been shrugged off so that the market can carry on and do its thing.

Yesterday, a fellow customer of one of the big US wireless telecom carriers received a spoofed call from my mobile number. He called me up thinking I had called him, and we started talking, and turns out he’s a Data Broker from the East Coast (I’m on the West Coast). He was very friendly and discussed specifics for how the mobile phone anonymous token works and how it’s supposedly a secure, anonymous arrangement.

I discussed with this gentleman the concerns from this article and he wasn’t too happy, naturally, given my disagreement with the practice of sharing such data due to such deanonymization concerns.

As I’m a bit of an activist regarding E2EE and voyeuristically supportive of certain disliked politicians, and against the described data sharing, I have to wonder if someone chose my number to play a prank. Of course, it could simply be an odd coincidence, which is the most reasonable base assumption. Still, I wonder why my number specifically was chosen to target this individual, who said he was the victim of substantial identity theft and yet has refused to change his phone number, likely due to the complexities in doing so.

I have a habit of consistently following up on such matters, and so perhaps someone was knowingly demonstrating to me that this wireless carrier can’t even stop in-network spoofed calls, aware that I would investigate it. Of course that’s a bit far fetched but who knows? If the offending party was able to cover their tracks then that says something about the absurd age we are in.

At the least, and unrelated to the original article, it’s clear that this major wireless carrier doesn’t even have the ability to prevent spoofed calls from within their own nationwide network from numbers associated with their own customers. I called their support and pointed out that, at least conceptually, it should be trivial to build a security feature to prevent this. And presumably shaken/stirred ss7 cert authentication for did’s should already cover in-network did authentication and prevent in-network spoofing. Is this a reasonable assumption? Have all the major carriers built these protocol upgrades to prevent spoofed calls?

There’s the outside possibility this gentleman lied to me about his carrier, dialed back the wrong number, or lied to me about the spoofed call but I gained the sense that he was being truthful to me.

Overall it seems that the cyber world is really quite a mess, whether with data sharing malfeasance per the article, insecure wireless networks, globally enabled ransomware, and ever-increasing data in the hands of private global entities that will exist beyond our lifetimes.

You don’t need leaks, you just need to read the marketing materials of these firms. They sell your data. They are ten times worse than what Google does in the worst fever dreams of the most tiresome DDG/Brave user on HN.

Starbucks has one of the most seamless payment and ordering systems I use on a day-to-day basis. I'm not sure why it's surprising they would have their own credit card to make that even easier. Heck, every big box store seems to have their own card too. They cut down on the transaction fees if it's their own card, plus extra data for them.

The only antidote to this kind of profiteering is a cultural shift. And if starts with us, the developers who are building this tech.

Unfortunately most of us are quite powerless to stop it otherwise. As time passes I'm only more convinced that this is an evil which will inevitably be abused by governments in the near future to target dissidents. And possibly other groups - you don't need much information from spending habits and location history to trivially build a profile consisting of religious affiliation, political affiliation, sexual orientation, and general interests. This maliciousness is putting us all at risk in the name of greed.